kainext-binance-mcp

Let an AI assistant read Binance markets, analyze them, and propose real-money trades — while a separate, human-gated process is the only thing that can ever execute. The model never holds a trade key, and nothing moves without a physical click.

The gate. Every order renders exactly what will execute — and the default button is Cancel.

kainext-binance-mcp is a Model Context Protocol server that connects any MCP client (Claude Code, Claude Desktop, …) to a Binance account. It exposes 25 tools, 5 analyst prompts and 8 knowledge resources spanning live market data, technical indicators, news & sentiment, derivatives positioning, market structure, portfolio/risk analytics, transparent trading signals, and two-phase order execution with a human in the loop — a complete, honest crypto analysis consultant in one install. It also ships an offline USD-M futures research engine (no tools, no keys, no network at import time) — see Futures research.

It is built around one uncompromising idea: treat the language model as untrusted. Even a fully prompt-injected or malfunctioning model cannot move your funds, because it has neither the credential nor the authority to do so. See SECURITY.md for the full threat model.

⚠️ Real money. On mainnet, every order moves actual funds. Always start on testnet and switch to mainnet only once everything is verified. ✅ Execution works on every OS (v1.2): native dialog on macOS, a local web confirmation page elsewhere, or a TTY prompt for headless boxes — see Confirmation backends.

Why this exists

LLM agents are great at reasoning about markets and terrible at being trusted with irreversible, money-moving actions. Most "AI trading" tooling hands the model an API key and hopes for the best. This project takes the opposite stance: the AI gets rich, read-only context and a way to propose an action, but a human holds the trigger and a separate process holds the key. You get the upside of an AI co-pilot for your trading without surrendering custody or control.

Security model — the headline feature

Two processes, least privilege, human-in-the-loop:

Releases are published to PyPI via trusted publishing and carry Sigstore digital attestations (verify any file at pypi.org/integrity/): what you install is provably what this repository's release workflow built.

sequenceDiagram
    participant AI as AI model (untrusted)
    participant S as MCP server<br/>(read-only key)
    participant C as Confirmer<br/>(trade key)
    participant H as You (human)
    participant B as Binance

    AI->>S: binance_spot_order_propose(...)
    S->>S: pre-validate vs symbol filters
    S->>C: canonical fields (local IPC socket)
    S-->>AI: intent_id (no order placed yet)
    C->>H: native dialog with exact fields ⚠️
    H-->>C: physical click: Confirm / Cancel
    C->>C: re-validate
    C->>B: execute (only if confirmed)
    AI->>S: binance_spot_order_status(intent_id)
    S-->>AI: pending → executed / rejected / expired

To execute one order you need both the trade key (isolated in the confirmer) and your physical click. The model has neither. Defense in depth on top of that:

• On mainnet, the server aborts at startup if its read key can trade.
• The confirmer aborts at startup if the trade key has withdrawals/transfer/margin/futures permissions or no IP whitelist.
• Withdrawals and transfers are permanently out of scope — no key enables them.
• Single-tenant: one server+confirmer pair serves exactly one account; run separate pairs for separate accounts.

Tools (25)

Read (5 · read key · no gate)

Market data — layer 2 (4 · read key · 100% read-only)

News & sentiment — layer 3 (2 · public RSS · no API key · 100% read-only)

Signals — layer 4 (3 · read key · propose, never execute)

Analyst — layers 5/6 (7 · read key + free public APIs · 100% read-only)

Write — two-phase (4 · execution is spot-only · the server never executes)

The read, market-data, news, and signal tools work without the confirmer. The *_propose tools require the confirmer to be running.

The knowledge layer — what makes it a consultant

Tools fetch data; knowledge tells the model how to think about it. The server ships its methodology through the two MCP surfaces most servers ignore:

Resources (kb://…) — read them from any MCP client:

Read the full README on GitHub →