autonomous-audit-mcp

An MCP server that lets an AI trading agent record, verify, and report its own decisions to a tamper-evident audit log — as native, agent-callable tools.

Thin Model Context Protocol wrapper around the open-source autonomous-audit tool (Apache-2.0, Python standard library only). No new audit logic — it exposes the existing hash-chain over stdio so an agent in Claude Desktop, Cursor, or any MCP client can build a tamper-evident decision trail while it works, without writing code.

Tools

Read-only with respect to any broker or market — it never places, modifies, or cancels orders; check_and_size_order is a cooperative calculation aid (not a technical broker-level blocker), and record_decision only appends to the local audit log you point it at. See SKILL.md for the recommended pre-trade + audit agent workflow.

Run

uvx autonomous-audit-mcp        # runs the MCP server over stdio

Register it with an MCP client, e.g. Claude Desktop (claude_desktop_config.json), Claude Code, or Cursor (local stdio/uvx servers run in desktop and IDE clients, not in claude.ai Web or Mobile):

{
  "mcpServers": {
    "autonomous-audit": { "command": "uvx", "args": ["autonomous-audit-mcp"] }
  }
}

Sidecar with Alpaca MCP or IBKR Autonomous Trading MCP

Run autonomous-audit alongside a broker MCP server so every agent trade decision (and resulting broker order ID) is recorded in a local SHA-256 hash chain before or right after execution:

• With Alpaca (alpaca-mcp-server):

{
  "mcpServers": {
    "alpaca": {
      "command": "uvx",
      "args": ["alpaca-mcp-server"],
      "env": {
        "ALPACA_API_KEY": "YOUR_KEY",
        "ALPACA_SECRET_KEY": "YOUR_SECRET",
        "ALPACA_PAPER_TRADE": "true"
      }
    },
    "autonomous-audit": { "command": "uvx", "args": ["autonomous-audit-mcp"] }
  }
}

• With Interactive Brokers (https://api.ibkr.com/v1/api/mcp-public) or Alpaca Hosted MCP (https://api.alpaca.markets/mcp): Keep your remote OAuth broker connector enabled in Claude Desktop / Claude Code / Cursor and add "autonomous-audit" above as a local sidecar. Instruct your agent to call record_decision with the broker order ID and rationale on every trade.

Scope & disclosure

Provides tamper-evidence (integrity + traceability): it detects post-hoc edits, reorders, and mid-chain deletions. It is tamper-evident, not tamper-proof durable storage, does not on its own satisfy statutory record-keeping (e.g. MiFID II), and is neither model explainability nor a regulatory approval. For educational and informational purposes only — not investment advice. See the autonomous-audit scope & regulatory context.

License

Apache-2.0.