Operator hardening¶

If you run the server for real funds — especially unattended or for other people — treat it like any money-moving service. This is the checklist.

Custody¶

[ ] Use KMS, not a raw key. Keep the signing key in AWS KMS with an IAM policy scoped to kms:Sign + kms:GetPublicKey on that one key. Reserve PRIMEDELTA_MCP_PRIVATE_KEY for dev/sandbox.
[ ] One key per agent, funded with limited funds — never a treasury or personal wallet.
[ ] Rotating is create-new-key → fund + KYC → swap PRIMEDELTA_MCP_KMS_KEY_ID.

[ ] Set PRIMEDELTA_MCP_MAX_TRADE_USD and PRIMEDELTA_MCP_MAX_DAILY_USD. With a KMS/raw signer there's no human approving trades, so these caps are your primary backstop — they reject an over-cap trade before it's even quoted.
[ ] The daily total is persisted at PRIMEDELTA_MCP_DAILY_STATE_PATH — make sure that path survives restarts.

[ ] Leave the gates off unless needed: ALLOW_DEPOSITS, ALLOW_WITHDRAWALS, ALLOW_ORDERS, ALLOW_SUBACCOUNTS are all off by default. Enable only the ones this deployment must have.
[ ] Tighten with allowlists where they fit:
PRIMEDELTA_MCP_SYMBOL_ALLOWLIST — only these symbols are tradable.
PRIMEDELTA_MCP_SEND_DEL_ALLOWLIST — addresses a native-token send may pay.
PRIMEDELTA_MCP_APPROVE_SPENDER_ALLOWLIST — spenders a token approval may grant.

[ ] Set PRIMEDELTA_MCP_NETWORK deliberately. The chain id is derived from it and checked against the RPC on startup, so a wrong custom PRIMEDELTA_MCP_PROVIDER_URL fails fast instead of trading on the wrong chain.

[ ] Never run HTTP without auth — the server refuses to. Use OAuth (PRIMEDELTA_MCP_OAUTH_OWNER_SECRET + PRIMEDELTA_MCP_PUBLIC_URL) or a bearer token (PRIMEDELTA_MCP_AUTH_TOKEN). See Connect Claude web.
[ ] Terminate TLS in front of the server; only GET /healthz should be reachable unauthenticated.
[ ] Keep the auth secret out of logs and shell history.

[ ] Know the kill switch: halt() blocks all trading immediately; cancel_order still works so you can pull resting orders. resume() re-enables.
[ ] Watch session status as a health signal — mode, signer, caps with the day's usage, gates, active allowlists.
[ ] Start any new setup on testnet and treat the first mainnet trade as a small live-fire test.