agentic · console · read + compile + prepare
Agentic Console
What your agent can do through HISS right now, how to wire it, what constrains it, and what actually happened — capability truth, per-rail state chips, and verifiable receipts. Built for the Robinhood Trading MCP.
Your brokerage data never touches a HISS server. Your agent session — on your machine — holds the Robinhood connection, reads your accounts, and renders what you see. HISS-hosted services do five things only: read public state, compile, constrain, prepare, and reconcile-verify. They never receive credentials, account numbers, positions, balances, order history, or order ids. There is nothing on HISS infrastructure to leak, because nothing brokerage-shaped ever arrives.
HISS-hosted services never hold Robinhood credentials or unrestricted signing keys. Orders are placed only by your own authenticated agent session, inside your own Robinhood Agentic account, within the limits you authorized — account-side in Robinhood, capsule-side in HISS. HISS compiles and verifies; it does not execute. Compile receipts are hard-typed liveOrderSent: false; execution receipts name the executor: "user-agent-session".
Built for the Robinhood Trading MCP. Not affiliated with Robinhood, Bankr, or Chainlink. Not investment advice.
agentic stack · per-rail state · never one global badge
- Robinhood Trading MCPREADY TO CONNECT
- HISS MCPLIVE
- Robinhood ChainLIVE
- Bankr rails (deposits · stock tokens)USER EXECUTIONYour Bankr session executes — HISS validates + receipts.
- Stock Premium LPREADPREPAREUser-signed execution BLOCKED: owner-gated off, no canary executed.
- Vault V2 (24/7 mesh)ACTIVE 24 7
- Lighter (Robinhood instance)PREPARE
- Coil compilerLIVE
- Risk fusesLIVERuntime enforcement BLOCKED — companion architecture-gated.
- ReceiptsLIVERuntime receipt classes are shipped types with zero production instances.
Evidence — what backs each state
- Robinhood Trading MCP: Committed capability matrix rev 2, verified 2026-07-22 (docs/mcp/capability-matrix.json). Tool schemas are UNKNOWN and fail closed.
- HISS MCP: Live in-process /version read — toolset sha256:d4ca4e50b438ec079658bb65490679424018f2f944ec888d5f00cf6a8bb42496.
- Robinhood Chain: GET /api/status (canonical StatusTruth: RPC probe + committed artifacts, degraded-capable).
- Bankr rails (deposits · stock tokens): GET /api/agents/schema + SKILL.md Part IV (artifact-derived rail boundaries; rh-wallet is source-pending, BLOCKED, never a dependency).
- Stock Premium LP: Hosted MCP toolset (SPL tools) + the SPL scanner reads; UNKNOWN halts prepares.
- Vault V2 (24/7 mesh): GET /api/vaults/v2/status — the typed activation enum, rendered verbatim.
- Lighter (Robinhood instance): LIGHTER_CURRENT_RUNG in @hiss/core (typed rung ladder) + public reads at /api/lighter/markets · orderbook · depth.
- Coil compiler: Typed @hiss/core version literals; local MCP toolset pinned by tests; liveOrderSent: false hard-typed.
- Risk fuses: Static @hiss/core fuse constants (no network, no failure mode).
- Receipts: @hiss/core/receipts + /app/verify; the on-chain VaultReceiptRegistry read is degraded-capable via /api/status.
- A failed read renders UNKNOWN — never “live”, never “not deployed”. Degraded reads show the last verified state, labeled.
robinhood trading mcp setup · your session, your account
READY TO CONNECTFour steps, all in your control. HISS is not part of Robinhood’s flow and never sees the login.
01Enable an Agentic account on Robinhood (desktop)
Agentic Trading is enabled in your own Robinhood account, on their desktop surface, under their terms. HISS is not part of that flow and never sees your login.
02Connect the official Trading MCP to your agent
Point your agent at Robinhood's official Trading MCP endpoint. With Claude Code, that is one command (below). The connection is yours — HISS holds no credentials.
claude mcp add robinhood-trading --transport http https://agent.robinhood.com/mcp/trading
03Set your budget controls on BOTH sides
Set the account-side budget in Robinhood AND the capsule-side budget here. The capsule's maxTotalNotionalUsd, per-order cap, and turnover fuse are compiled into every instruction block.
04Turn on notifications and know the disconnect switch
Enable order notifications so you see every action as it happens, and know where the MCP disconnect lives. Stopping the agent must always be one step, not a support ticket.
hiss mcp setup · two different servers
LIVELocal stdio server
The full local toolset — the Coil compiler, vault reads, receipts, and post-run audits — runs on your machine over stdio. Tool names are pinned by tests; nothing here executes.
Hosted mcp.hiss.finance
Serving 39 tools right now (read + prepare only). The served toolset identity is dynamic — never hard-coded.
toolset sha256:d4ca4e50b438ec079658bb65490679424018f2f944ec888d5f00cf6a8bb42496
account-capability discovery · session-proven, fail-closed
The verified Robinhood Trading MCP surface: 50 tools verified at name level (capability matrix rev 2, verified 2026-07-22), with 9 frozen UNKNOWNs — every one a runtime fail-closed default. All tool schemas are auth-walled and UNKNOWN until your session discovers them.
- · Your session runs tools/list against the Trading MCP — HISS never performs discovery server-side.
- · Order types, time-in-force, and options level are proven per session, never assumed.
- · A capability the snapshot does not VERIFY cannot be asserted by any Coil — the compiler narrows, never widens.
agentic account identity · fingerprints, never account numbers
The Agentic account is the write-scope target — your agent can only place trades there — while reads span all your Robinhood accounts. Your session identifies the Agentic account locally; HISS artifacts reference it only as a salted, domain-separated accountFingerprint commitment. No HISS artifact, receipt, or API ever carries an account number, and this console renders no field for one.
coil library + builder
LIVEA Coil is data, never code: a declarative manifest with integer basis points, an explicit universe, and mandatory fuse coverage. Same inputs, same Coil, same hash.
scanner → coil
PREPAREScans run in your session, user-initiated (a scan is a write on the Robinhood side). Scanner output is UNTRUSTED input: candidates only, validated against the Coil grammar before anything compiles. The compile path is live; the automated scanner runtime is simulated. Scan results are never recommendations — nothing here is investment advice.
strategy engines · simulated until receipts prove otherwise
DCA
◈ SIMULATEDScheduled buys with per-order and total caps compiled into the program.
P1: triggers are serialized — one evaluation at a time, never concurrent.
Trailing stop
◈ SIMULATEDA stop level that ratchets with price and only tightens.
P2: no auto-chase — a missed level is never chased with market orders.
Synthetic bracket (OCO)
◈ SIMULATEDA take-profit and stop pair maintained as one bracket.
P5: gap-through semantics are explicit — gaps resolve to the protective leg.
Risk exit
◈ SIMULATEDExit conditions bound to drawdown and loss fuses.
P3: kill switches exempt nothing — a halt stops exits too, with a journaled resume.
Scanner
◈ SIMULATEDUser-initiated scans producing UNTRUSTED candidates for validation.
P4: skipped windows are journaled, never silently dropped.
Rebalance daemon
▣ RESEARCHTier-2, spec state — designed, not shipped. Nothing about it runs anywhere.
Every engine is a pure kernel plug-in; none executes anywhere today. Behavior honesty is a feature: each card names its structural policy.
simulated mode · never mixed with execution
Simulated runs are deterministic evaluations against recorded or fixture inputs, always labeled SIMULATED. Simulated results never mix with execution-attributed outcomes, and no leaderboard renders unless it is backed by execution-receipt-attributed results — none exist today, so no leaderboard renders.
live-autonomy grants · a chat sentence is never authorization
READYLive autonomy requires the typed, signed, bounded, expiring, revocable LiveAutonomyGrant: six named things — coil hash, runtime hash, account fingerprint, allowed actions, numeric bounds, time window. Compile-time acknowledgment flags are separate from the grant, and both are required: no ack + grant, no autonomy — at the type level. Revocation scopes: grant · account · global.
Current authority state: no_grant / unpaired — authority state composes only from a paired local companion, and this public surface has none. It is never inferred.
receipts + verification · the unit of trust
LIVE| Stage | Artifact | Asserts |
|---|---|---|
| Preparation | hrcpt_ compile receipts | HISS compiled this; liveOrderSent: false. Live and verifiable today. |
| Submission | xrcpt_ execution receipts | Your session submitted. Typed, zero production instances; never publishable at this level. |
| Settlement / outcome | orcpt_ outcome receipts | What actually resulted — derived-only, null-not-estimated. PnL attribution comes only from here. |
| Reconciliation | broker order-list diff · chain tx | Reconciled against the source of record; ambiguity halts the coil, never blind-retries. |
Simulated and live results never share a table.
kill + pause layer · client-side, stated exactly
The kill layer is client-side: pause a coil, pause all, revoke the grant, stop the runtime — plus disconnecting the MCP, and Robinhood’s own account-side controls in Robinhood’s own UI. Two facts are verified-absent on the Robinhood Trading MCP surface: there is no server-side kill-switch tool, and no bulk cancel-all — cancels are per-order. Stopping is never the scarce permission: runtime control ships in the DEFAULT companion capability set. Kills exempt nothing — a halt stops exits too, and resuming is a journaled user action.
This console renders kill state and instructions only; actual control operations exist through the local companion transport, not through any HISS-hosted endpoint.
risk fuses · never loosen, UNKNOWN fails closed
LIVEREADYThe fuse catalog spans position, loss, velocity, symbol, liquidity, and policy fuses, plus 6 agentic extensions. Compile-time enforcement is live: every capsule must carry at least 5 required fuses, and agentic capsules the 9-fuse superset — including killSwitchPolicy, maxOrdersPerDay, maxDailyRealizedLossUsd, and allowedSymbolsOnly. Runtime enforcement is BLOCKED pending the companion architecture.
- · L1 — fuses never loosen; inheritance is strictest-wins.
- · L2 — validate twice; execution-time evaluation is authoritative.
- · L3 — every fuse evaluation is receipted.
- · L4 — halts are typed, never silent.
- · L5 — UNKNOWN fails closed, everywhere.
- · Adaptation is tighter-only.
compile a coil into a capsule
capsule compiler · deterministic, client-side
7 holdings · 11 fuses · stored mode paper_only
paper_only compiles a runbook and receipt but no execution capsule — that gate lives in the compiler itself, not just this page. Pick preview_only or human_confirm to produce a capsule.
Compiling produces text and JSON for your own agent. It never contacts Robinhood and never sends an order.
Not affiliated with Robinhood. Not investment advice. Capsules are instruction bundles for your own agent — every receipt is verifiable, and liveOrderSent: false is hard-typed into all of them.