AI Agent Trading Leaves Dealing Desks Unable to Identify Orders

Retail FX and CFD brokers are increasingly integrating AI agent trading into their platforms, but dealing desks often cannot tell when an AI agent, rather than a human or an Expert Advisor (EA), is making the trading decisions, according to an analysis by Marios Kyriakou, Head of FX Dealer Academy by Your Bourse.

MetaQuotes has introduced native support for the Model Context Protocol (MCP) in MetaTrader 5, while Spotware launched cTrader AI Agent Connect. Match-Trade first launched an MCP for brokers and later extended it to traders. On these platforms, traders can connect external AI agents such as Claude to perform trading operations on a live account.

AI agent trading: What MCP Enables and Why It Matters for Dealers

MCP is an open standard that sets common rules for how AI agents connect to other software. A trading platform or third party builds an MCP server, and any compatible AI agent can connect to it. The server offers the AI a list of permitted actions; once connected, a trader can request actions such as closing a EURUSD position, and the AI executes the instruction.

On official platform servers, almost anything a trader can do by clicking on the platform can now be done by an AI agent on their behalf. This matters for dealing desks because they tend to make decisions and handle each trader's flow based on past trading activity.

Setup is simple. With remote setups, the trader gets a token for each trading account and pastes it into their AI tool. With local setups, the AI connects through the platform running on the trader's computer. In both cases, the trader can usually choose whether the AI is allowed to trade and whether each trade needs approval. If approval is turned off, the AI can open, modify and close real trades on its own.

For the dealing desk, three issues stand out: the settings controlling what the AI can do are in the client's hands; with remote setups, the access token sits in a third-party AI tool the broker does not control; and with local setups, the AI's orders go through the same login session as the trader's own clicks, so they may look the same to the broker.

Other MCP Setups and Safety Controls

Beyond official servers such as those built by MetaQuotes and Spotware, traders can use open-source MCP servers that link AI agents to trading platforms through existing APIs. Some vendors offer hosted versions that work across several platforms at once, and traders with coding skills can build their own custom servers.

Safety controls depend on whoever built the server. The official servers let traders keep the AI read-only until they trust it or require approval for each trade. Other setups may not offer these controls, meaning real trades can come from untested software with no way for dealers to know.

With hosted versions, the trader's login details or access token sit with a third-party company. Because these servers are not built by the platform provider, the broker has no record of what the AI did or why. The orders reach the platform through its regular API or terminal, just like any other order.

Some setups do give the broker visibility. ThinkMarkets, for example, has started offering its own MCP server, in which case the broker controls the server and can see what the AI does. But this is only possible because ThinkMarkets runs its own trading platform; brokers that do not own a trading platform depend on the provider for this kind of visibility.

Can the Desk Tell Human, EA or AI Agent Apart?

Not always. Platforms such as MetaTrader indicate whether an order was placed from the desktop, mobile, web or by an EA, and this information is recorded and available to the dealing desk. However, Kyriakou said that from his own experience working at major brokers for years, dealing desks have trouble even identifying EA trading, as some traders have found ways to bypass the platform's ability to identify it. Instead of "EA", the back-end software used by dealers shows, for example, "mobile" as the source. For AI agents, there is no label at all.

Some open-source MT5 MCP servers only work if the trader turns on algorithmic trading in the terminal. In those setups, the AI's orders may appear with the EA label. The AI still has no label of its own, and the desk may simply see it as another EA.

Trading behaviour usually helps where labels fail. Kyriakou said experienced dealers can identify human trading because human traders act at uneven speeds, deviate from their strategies due to psychological factors, and usually trade during active market hours. An EA trades only when specific criteria in its code are met, so it follows a clear pattern, and EAs usually rely on technical analysis rather than fundamental analysis. Only automated systems can send orders one after another within milliseconds, which is a clear sign of automated trading. An AI agent, however, takes everything into account, and its behaviour is mixed and random, making it difficult to identify.

A dealer can find real proof that an AI is trading only through the MCP server, which can record which account the AI used and every action it took. Brokers only have access to these records if they run their own server or the platform provider shares them. For most brokers, that information is out of reach.

Risk Management Implications

AI agents make book allocation decisions even more difficult. A client profiled as a losing manual trader may suddenly trade with the speed and discipline of a machine and even start making large profits, while the dealing desk still treats the flow as safe to internalise. This makes ongoing assessment of client profiles an even more crucial part of risk management.

Correlated flow and concentrated exposures can become more common. Many traders use the same AI models, prompts and open-source MCP servers, and they may react in the same way to market conditions, trading in the same direction at the same time. That concentration can turn into a sudden and serious exposure.

AI can make mistakes. AI agents can misread an instruction, unlike an EA, which simply runs its code. This creates the risk of disputes. Without the MCP server's records, the broker cannot show what the AI did, what the client instructed or who is responsible. This can lead to complaints, reputational damage and questions from regulators, who expect brokers to know their clients and keep proper records of their trading. An AI agent could also trigger suspicion of market manipulation without anyone intending it.

AI agents can also be misled by false information. They can connect to multiple MCP servers and may use faulty third-party tools, incorrect prices, incomplete calendars and potentially inaccurate add-ons. Fake or compromised information can feed into the AI, which may then trade based on it. The broker sees only normal orders, while the trader may lose money without understanding why and could complain to the broker.

Security risks exist as well. With hosted MCP servers, the trader's login details or access token sit with a third-party company. Some open-source servers also run using the trader's login and password, with code that nobody may have checked. If either is hacked or misused, someone else could trade on the account, and to the broker, these trades would look like the client's own.

AI agent trading is now available on several platforms brokers use, and its use by traders is expected to grow. Kyriakou said client profiling has always been one of the desk's most important risk management considerations, especially for book allocation decisions. AI agents make profiling harder, and dealers need to review profiles more often, watch for sudden changes in behaviour, closely monitor correlated flow and push platform providers to label MCP orders.