cdcx-autonomy-levels

Autonomy Levels

Philosophy

Agents should operate at the lowest autonomy level that accomplishes their task. Each level upward trades human oversight for agent independence.

Safety Tiers (the underlying mechanism)

Every cdcx MCP tool is classified into one of four tiers:

Tier	Agent Behaviour	Example
read	Runs freely, no acknowledgement	cdcx_market_ticker
sensitive_read	Runs freely, no acknowledgement	cdcx_account_summary
mutate	Requires acknowledged: true in tool arguments	cdcx_trade_order
dangerous	Refused unless server was started --allow-dangerous	cdcx_trade_cancel_all, cdcx_funding_withdraw

Level 0 — Read-only

Agent can observe the market but cannot touch the account.

cdcx mcp --services market

MCP config:

{"command":"cdcx","args":["mcp","--services","market"]}

Use for: market research agents, price alerts, chart commentary.

Level 1 — Paper

Agent can read live market data plus read authenticated account info; any actual trading is paper-only and handled CLI-side (not via MCP).

cdcx mcp --services market,account

Pair the MCP server with shell access to cdcx paper for simulated execution. Paper has no MCP tools; execution stays outside the agent's tool surface.

Use for: strategy research with real account context, backtest harnesses.

Level 2 — Supervised Live

Agent can place and cancel real orders, but every mutation requires explicit acknowledgement from the host application (human-in-the-loop).

cdcx mcp --services market,account,trade,advanced

The agent calls cdcx_trade_order; the host MUST echo the intent to the human and only pass acknowledged: true once approved. Dangerous tools (cancel-all, withdraw) are refused at the server since --allow-dangerous is not set.

Use for: semi-automated trading with human oversight, production with guardrails.

Level 3 — Autonomous

Agent executes anything without per-call confirmation. Dangerous tier is available.

cdcx mcp --services market,account,trade,advanced,funding --allow-dangerous

Even at level 3, mutate tools still require acknowledged: true in the tool arguments — but an autonomous agent will pass it automatically without a human prompt. --allow-dangerous additionally unlocks cancel-all and withdrawals.

Use for: fully automated strategies with external risk controls (position limits, drawdown circuit breakers, monitoring alerts). Rare in production.

Promotion Criteria

From → To	Requirement
0 → 1	Agent correctly interprets market data, no hallucinated instruments
1 → 2	Strategy is profitable or sound on paper; agent handles API errors gracefully
2 → 3	Agent has operated supervised without unexpected actions for a meaningful period

Service Group Reference

Valid MCP service groups: market, account, trade, advanced, margin, staking, funding, fiat, otc, stream, all.

• account also exposes history (orders/trades/transactions)
• funding maps to the wallet CLI group (deposit/withdraw/networks)
• paper is not an MCP group — paper trading is CLI-only
• all includes everything above

Notes

• Withdrawals (funding withdraw) should only be unlocked at Level 3 and only with --allow-dangerous; they are the highest-risk action available
• You can run multiple cdcx MCP servers side by side with different autonomy levels (one agent at level 1, another at level 2)
• --allow-dangerous only affects the dangerous tier. Mutate tools always need acknowledged: true regardless