But Scalable’s own documentation sets a more important boundary than the early coverage suggests: agents can prepare and manage investment actions, yet orders require the customer’s approval before execution. That means this is not a hands-off trading bot that can independently react to a price move and buy or sell securities without a human signing off.
That distinction was blurred in the original report published by FSTech, which said an agent could “buy and sell automatically” for customers. Scalable’s product page instead says users approve orders before they execute, can turn agentic access on or off at any time, and that agents never handle payments. The available evidence points to prompt-to-trade, not autonomous portfolio management.
For Windows users, developers and IT administrators experimenting with agent connectors, the launch is useful precisely because it exposes the security and governance questions usually hidden behind a brokerage app’s conventional interface. A prompt can now reach a system that has access to holdings, transactions, watchlists, price alerts and potentially trade preparation. The technology is familiar; the consequences of an overly broad permission are not.
Scalable’s MCP server turns a broker account into an AI tool
MCP is an open protocol designed to let an AI client discover and call tools supplied by another service. In practical terms, Scalable is exposing broker functions in a format an AI agent can use rather than requiring customers to navigate every screen manually or rely on browser automation.
Scalable’s examples show the range. A customer can ask for an export of crypto ETP transactions during the 2025 calendar year in CSV format for tax preparation, request an account dashboard with holdings and price charts, compare a portfolio with a model portfolio, change a limit on an existing order, or prepare a savings-plan order. Agents can also work with price alerts and watchlists.
The immediate value is less glamorous than algorithmic stock picking. Portfolio exports, transaction lookups, recurring summaries and watchlist maintenance are repetitive jobs that normally require several clicks, spreadsheet work or manual copy-and-paste. A well-scoped connector can turn those tasks into a conversational request while leaving the brokerage’s systems as the source of record.
Scalable also offers an official command-line interface for developers and advanced users. Its open-source CLI supports structured JSON output, local scripts and agent workflows, positioning it as an alternative to Selenium-driven browser automation or scraped web sessions. That is a genuine engineering improvement: supported commands are more stable, more auditable and less likely to break when the broker changes a page layout.
The CLI’s documentation is also more explicit about a control that should matter to anyone building automation around a financial account: sensitive actions use a two-step confirmation flow. Scalable advises users to complete login themselves instead of delegating that step to an AI agent.
This division between the cloud-hosted MCP server and a locally run CLI deserves attention. MCP is designed for conversational access through an AI client, while the CLI is aimed at terminal-based automation and custom scripts. The former lowers the barrier for retail users; the latter gives technical users structured commands they can inspect, compose and place behind their own controls.
The broker’s approval requirement changes the risk story
Scalable’s announcement has arrived amid a rush to describe every AI-connected financial product as “agentic.” The word creates an impression of a system independently monitoring markets and placing trades. Scalable’s actual implementation is more restrained.
Its product material says customers retain control by approving orders before execution. The company’s page separates functions into analysis, monitoring and execution, then states that the agent may trade and manage a portfolio with the customer’s approval. It also says that payments are never handled by agents.
That does not make the connection low-risk. An AI agent can still analyze sensitive financial information, generate a trade proposal, populate an order or alter an existing order’s limit. A user distracted by a long agent conversation could approve an action without carefully reviewing the instrument, quantity, order type, price limit or account selected.
The security boundary is especially important because the broker is not supplying the model that interprets the prompt. Scalable says MCP and CLI are interfaces to independent external AI applications, that use and data transmission are at the user’s own risk, and that AI-generated outputs and transactions originate with the third-party tool rather than Scalable. It also disclaims responsibility for the accuracy of AI output.
That disclaimer is commercially understandable, but it places the operational burden on the customer. Connecting a broker account to an AI service means deciding which provider receives portfolio context, how long that provider retains conversation or tool data, who can access the AI account, and what instructions can be carried from the conversation into a financial action.
Independent German outlet Aktiengram, which walked through the setup, reported that users must enable Agentic Investing in Scalable’s web portal, confirm that activation in the mobile app, authenticate to the broker during connection, and pass another two-factor check. It also reported that the AI client’s connector settings can classify commands as requiring approval, always allowed or blocked.
Those controls are more consequential than the novelty of typing an investment request into a chatbot. A “always allowed” setting may be appropriate for a harmless portfolio export, but it is a poor default for modifying orders, savings plans or alerts. Users should treat the agent connector as a privileged application, not as a disposable chatbot integration.
MCP’s security model is being tested by high-consequence tools
The Model Context Protocol specification requires OAuth-based authorization practices for remote MCP connections, including protected token handling, HTTPS and authorization-code safeguards. Those are necessary protocol foundations, but they do not decide whether a particular prompt is safe, whether an agent has accurately interpreted it, or whether a user understands the action being approved.
The National Security Agency warned in May that MCP is increasingly being used for sensitive tasks across business, finance and legal systems. Its guidance on AI-driven automation focuses on a problem Scalable users will recognize immediately: an agent is not simply reading a document. It can be given access to an external system and instructed to act.
For administrators, this is the same principle that applies to a coding agent connected to a production repository or cloud tenant. Authentication proves who connected; authorization establishes what the connection can do. Neither control guarantees that an AI system will make a sound recommendation or avoid being misled by hostile text in a website, document, email or data feed.
In the broker setting, the obvious prompt-injection scenario is not a malicious command typed directly into ChatGPT or Claude. It is third-party content that an agent has been asked to summarize or analyze—market commentary, a company announcement, an imported spreadsheet or a news item—that contains instructions intended to influence the agent’s next tool call. If the agent can create orders or change alerts, users should assume every external source is untrusted input.
Scalable has not publicly detailed the precise scopes exposed by its MCP authorization flow, the lifetime of its access tokens, the audit information retained for agent actions, or whether customers can create read-only access profiles at the broker level. Its page promises transparent activity tracking in the web interface and app, but it does not spell out whether every tool request, generated draft and approval decision is preserved in an exportable audit log.
Those omissions do not prove a defect. They do mean developers and security-minded customers cannot yet assess the full control model from the public launch material. For a connector able to reach financial records and prepare trades, a least-privilege design is the baseline readers should expect—not an optional enhancement after broad access has shipped.
Practical guardrails for anyone connecting an agent
Scalable customers considering the feature should begin with a narrow use case: read-only analysis, transaction exports or watchlist summaries. The first task should not be automated order management, even with an approval screen at the end.
A sensible setup separates low-risk and high-risk capabilities:
- Enable access only when it is needed, and disable it after testing rather than leaving a persistent connector attached to the account.
- Require confirmation for every action that creates, changes or cancels an order, savings plan or price alert.
- Block any capability that is not required for the chosen workflow, especially where the AI client permits an “always allow” rule.
- Use a dedicated AI account with strong multi-factor authentication, no shared browser session and no credentials supplied to the agent in chat.
- Review the final broker-side order ticket—not merely the AI’s prose summary—before approving a trade.
- Prefer the official Scalable CLI for local, deterministic workflows where a script and its parameters can be version-controlled and reviewed.
The strongest near-term use case may be the least autonomous one: use an agent to organize information, draft an investment action and surface what needs attention, then let the customer make the final decision in the broker’s approval flow. That keeps the benefits of structured access without pretending a general-purpose language model is a licensed, reliable portfolio manager.
Scalable founder and co-chief executive Erik Podzuweit told Reuters that customers may be hesitant to let ChatGPT view or manage a portfolio and characterized the release as a first step toward broader AI use in Scalable’s app. The product’s approval requirement suggests the company recognizes that hesitation is rational.
The technical milestone is real. Scalable has made a regulated retail-broker account callable by mainstream AI clients and by developer tooling without asking users to resort to brittle screen scraping. The practical milestone will be whether Scalable provides enough scoped permissions, activity records and revocation controls for users to connect an agent without turning a portfolio assistant into an unnecessarily powerful account key.