Binance Agent OS · MCP copilot

Observe. Plan. Approve. Then act.

BOSS is a permission-first Spot copilot on Binance Agent OS. Say “plan buy 5 usdt BTCUSDT”, and it sizes to exchange filters, runs a fail-closed policy gate, and only mints a send token after you type EXECUTE.

Launch app → Read the safety model

Runs in this browser · live mainnet data · permission gate active

Checking engine… BTC — — ms LIVE · BINANCE SPOT

14BOSS MCP tools

20+Policy rules per plan

0Invented prices

20Tests passing

Live command trace paper-safe hosted mode

Connecting to engine…

How it works

Four layers, one engine, one gate

Everything an agent can do goes through the same desk session: observe, analyze, plan, approve, send. Every order crosses the same policy matrix. MCP and the web UI share one process — what your agent does is what the dashboard shows.

Market observer

Live ticker, depth, 1h/4h candles, 20-symbol tape, Web3 pulse boards.

Research engine

Technical snapshot, RSS headlines, Fear & Greed, scored bias — no hallucinated prices.

Policy gate

BLOCK, UNKNOWN, or CLEAR with every rule visible. Missing data never treated as zero.

Agent OS bridge

EXECUTE mints a one-time token. Agent OS sends exact packet fields + HMAC stamp.

Observe

Pull live Spot evidence, Web3 boards, and optional analysis report.

Plan

Size quantity to lot step, tick, and min-notional. Gate runs immediately.

EXECUTE

Single-use approval token (60s). Nothing sends until you type the phrase.

Reconcile

Hash-chained receipts classify AUTHORISED vs FOREIGN / FORGED / MISMATCHED.

Architecture

One process, two MCP servers, one desk

Cursor / Claude hosts talk to BOSS MCP and Binance Agent OS MCP. BOSS never replaces Agent OS — it sits in front as the permission and policy layer.

MCP hosts

Cursor · Claude Code · Codex · VS Code

BOSS MCP

/mcp · observe · plan · approve · packet · reconcile

Binance Agent OS

agent.binance.com/mcp/agentic · account + Spot send · no withdrawal scope

Safety by construction

Fail-closed gate, every verdict with a reason

Public desk runs live market data through the same policy gate as local BOSS — observe, analyze, and plan with real Binance Spot feeds.

Verdict	Meaning
BLOCK	Hard rule failed. No approval, no send.
UNKNOWN	Required fact missing (usually balances). Plan allowed; send refused.
CLEAR	Gate open — you still must type EXECUTE.

HMAC order stamps

Every approved packet carries boss_<seq>_<mac>. Copying the prefix is not enough.

Scope burn

FOREIGN / FORGED / MISMATCHED orders burn trade scope until restored from the desk.

Default caps

100 USDT per order · 500 USDT per UTC day · Spot only · withdrawals never.

What BOSS never does

Send without EXECUTE

Approval tokens are single-use and expire in 60 seconds.

Invent a price

If Binance is unreachable, BOSS stops — no placeholder fills.

Change your packet

Agent OS must send the exact fields BOSS approved, including the stamp.

Connect your agent

BOSS is an MCP server. Point any host at it.

Start locally with npm start (127.0.0.1:8790/mcp), or point Cursor at the hosted MCP endpoint below.

// loading MCP config from /api/health…

boss_status boss_observe boss_tape boss_analyze boss_plan boss_attach_account boss_approve boss_packet boss_reconcile boss_audit boss_receipt boss_mandate