MCP, the Model Context Protocol, is an open standard that lets AI apps connect to outside tools, data and accounts through one common plug. Exchanges adopted it because a single MCP connector lets any compatible AI assistant read markets and place orders on their platform. In early March 2026, three of the largest exchanges released competing agent toolkits within about a week.
How does MCP actually work?
MCP works like a universal adapter between an AI app and the services it needs. Before it existed, every pairing of AI app and service needed its own custom integration. With MCP, a service builds one connector, called an MCP server, and any AI app that speaks MCP can use it.
The MCP specification describes three roles:
- Host. The AI application you use, such as a chat assistant or a coding tool.
- Client. A connector inside the host that talks to one server.
- Server. The service that offers data and actions, such as an exchange, a wallet or a data feed.
They exchange structured messages in JSON-RPC 2.0, a long-established format for one program asking another to do something. A server can offer three kinds of things: resources (data for the AI or user to read), prompts (ready-made instructions and workflows) and tools (functions the AI model can run, such as “place order”).
Tools are what turn a chatbot into an agent. Once a model can call “get balance” or “submit trade”, it is no longer just answering questions. It is taking actions.
MCP was released as open source in November 2024 by one AI developer and handed to an open-source foundation in December 2025. Industry reporting put its official software kits at about 97 million monthly downloads, with more than 10,000 active servers, as of March 2026.
Why did exchanges rush to adopt it?
Exchanges adopted MCP because it is the cheapest way to make their platform the default place where AI agents trade. One connector reaches every compatible AI assistant at once, instead of one partnership at a time.
The timing in 2026 was tight. Industry reporting gives this sequence:
| When (2026) | Who | What shipped |
|---|---|---|
| 3 March | The world’s largest exchange | An open-source hub of seven agent “skills”, covering market data, spot orders, wallet analytics and contract risk checks |
| About four hours later | A second top exchange | An MCP toolkit that its own documentation now lists at 82 tools across seven modules, for spot, futures and on-chain actions |
| By 9 March | A third large exchange | An upgraded agent hub with 58 tools in nine modules, building on MCP support added in mid-February |
Two things are worth being precise about. First, “every exchange” overstates it. Several of the biggest moved, but not all toolkits are MCP-based. The first launch in the table is described as a skills hub, and the reporting does not say it uses MCP.
Second, adoption is a distribution play as much as a technical one. In our judgement, the race is less about MCP itself than about which platform agents reach for first. MCP just made that race fast and cheap to enter.
What can an exchange MCP server let an agent do?
An exchange MCP server can let an agent do anything the account’s API key allows, from reading prices to placing orders. An API key is the password-like credential that lets software act on your account. What it permits is the real limit on what the agent can do.
| Permission level | Example actions | Risk if the agent gets it wrong |
|---|---|---|
| Public data only | Read prices, order books, market rankings | Low: bad analysis, no account access |
| Read account | See balances, positions, trade history | Medium: privacy exposure |
| Trade | Place, change and cancel orders | High: losses from bad or manipulated trades |
| Withdraw | Move funds off the exchange | Highest: funds can leave for good |
Design choices inside the toolkit matter. One exchange’s documentation says its MCP toolkit keeps API keys in a local file the AI model never sees, signs requests on the user’s own machine, and checks the key’s permissions at start-up. If the key cannot trade, the order tools are never offered to the agent at all. It also offers a demo mode with simulated funds.
That is a good pattern. It is not a universal one. The toolkit reporting we reviewed did not say whether any of the three supports or blocks withdrawals, so that is something to check yourself.
Is MCP safe?
MCP is a connection standard, not a safety guarantee, and the specification says so plainly. It states that tools amount to running arbitrary code and must be treated with caution. It says descriptions of what a tool does should be treated as untrusted unless they come from a trusted server, and that hosts must get the user’s explicit consent before running any tool.
The specification also admits that MCP cannot enforce these principles at the protocol level. Enforcement is left to whoever builds each app and each server. That is where the risks show up.
The biggest is tool poisoning: hiding malicious instructions inside a tool’s description, which the AI reads when it connects. A 2025 academic benchmark of tool poisoning tested 20 AI agent setups against 45 real MCP servers and 353 real tools, using more than 1,300 attack cases. The most vulnerable setup was fooled 72.8% of the time. Even the most cautious refused fewer than 3% of the attacks.
A 2025 academic study of 1,899 open-source MCP servers found general security vulnerabilities in 7.2% of them and MCP-specific tool poisoning in 5.5%. Industry reporting adds that many public MCP servers have never had a formal audit.
What could go wrong?
The realistic failure is an agent connected to a live exchange account with more permission than it needs, reading instructions it should not trust. Combine a key that can trade or withdraw with a poisoned tool or a malicious web page, and the agent can be steered into actions you never asked for.
Unofficial servers raise the stakes. Anyone can publish an MCP server that claims to connect to an exchange. If it is not the exchange’s own, it may be passing your key, your balances or your orders to someone else.
Speed is the other problem. One industry analysis notes that rate limits, position caps for agent accounts and machine-speed circuit breakers are still works in progress on the exchanges that launched toolkits. An agent can make many mistakes before a human notices one.
The trust takeaway
MCP is useful plumbing, and the safety lives in the settings around it, not in the protocol. Treat connecting an agent to your exchange like handing someone a key to your account: decide exactly which doors it opens before you hand it over.
Before you connect an agent to an exchange through MCP, check:
- Is the server official? Use only the exchange’s own published toolkit, from its own documentation.
- What can the API key do? Read-only or trade-only, with withdrawals switched off.
- Does the app ask before acting? Every order should need your approval until you trust it.
- Where does the key live? Ideally on your machine, never pasted into a chat.
- Can you test it first? Use a demo mode or a small sub-account before real funds.