AI Agent Tokenized Stock OS

by aatos.dev · remote · no sign-in to list tools · v1.1.0 · published by dev.aatos

Non-custodial MCP for Stock Tokens on Robinhood Chain (4663): quotes, plans, Morpho Earn.

Deletes · 1Final · 2Changes · 16

Compare Registry entry

37 tools: 1 can delete or cancel things, 2 do something that can't be undone, 16 change things and 18 only read.

Scanned Oct 21, 2026

Deletes or cancels1Claude Code: deny: see these tools
Can't be undone2Claude Code: ask: see these tools
Changes things16Claude Code: ask: see these tools
Only reads18Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http aatos https://aatos.dev/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warnstocktoken_quote
The server marks "stocktoken_quote" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.recipient): what it sends cannot be taken back.
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

37 tools

Deletes or cancels 1Removes, cancels or revokes something.Claude Code: deny

stocktoken_session_killKill an agent session immediately (kill switch).No findings
Why it is in this group
- The name "stocktoken_session_kill" says "kill": a word for removing or ending something.
Description, as the server wrote it
Kill an agent session immediately (kill switch).

Can't be undone 2Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

stocktoken_morpho_withdraw_planBuild non-custodial Morpho Earn withdraw (by USDG) or redeem (by shares) plan.No findings
Why it is in this group
- The name "stocktoken_morpho_withdraw_plan" says "withdraw": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it
Build non-custodial Morpho Earn withdraw (by USDG) or redeem (by shares) plan. Does NOT broadcast.
stocktoken_quoteQuote a Stock Token swap on chain 4663.1 finding
Why it is in this group
- The input addresses people (input.recipient): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "stocktoken_quote" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.recipient): what it sends cannot be taken back.
  What this check looks for
Description, as the server wrote it
Quote a Stock Token swap on chain 4663. Compares 0x, the Uniswap API, on-chain Uniswap v3, and hookless Uniswap v4, and returns the executable route with the higher amountOut. If none is executable, the result is oracle-indicative and is not a fill. Pro required. Does not sign or broadcast.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true

Changes things 16Creates or changes something that can be changed back.Claude Code: ask

stocktoken_access_activateAfter ETH payment to treasury is confirmed, verify and issue API key (shown once).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
After ETH payment to treasury is confirmed, verify and issue API key (shown once).
stocktoken_access_checkoutBuild on-chain ETH payment plan for Pro/Team.No findings
Why it is in this group
- The name "stocktoken_access_checkout" says "checkout": a word for a change.
Description, as the server wrote it
Build on-chain ETH payment plan for Pro/Team. After user pays, call stocktoken_access_activate.
stocktoken_execute_planBuild an unsigned swap plan on chain 4663.No findings
Why it is in this group
- The name "stocktoken_execute_plan" says "execute": a word for a change.
Description, as the server wrote it
Build an unsigned swap plan on chain 4663. Picks the executable venue with the higher amountOut (v4, v3, 0x, or Uniswap API). Steps are an ETH fee of about 10 bps, token approve, and the swap. v4 also adds a Permit2 approval. Does NOT sign or broadcast. Pro required. The user signs. A v4 plan expires 30 minutes after it is built.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
stocktoken_explain_routingStart here.No findings
Why it is in this group
- The name "stocktoken_explain_routing" says "explain": a word for reading.
- The description's first verb is "start": a word for a change.
Description, as the server wrote it
Start here. Brokerage equities go to Robinhood Trading MCP. Stock Tokens on chain 4663 stay here: stocktoken_list, stocktoken_price, stocktoken_quote, stocktoken_execute_plan.
stocktoken_intent_typed_dataBuild EIP-712 typed data for an agent trade intent (offchain authorization standard).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Build EIP-712 typed data for an agent trade intent (offchain authorization standard). User/wallet signs; onchain verifier later.
stocktoken_liquidity_matrixLiquidity matrix for major USDG pairs on chain 4663.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Liquidity matrix for major USDG pairs on chain 4663. each row reports hookless Uniswap v4 and on-chain v3. eitherExecutable true means at least one of those can fill the sample size. A false row is not every pool on earth: hooked v4 pools are not scanned. If stocktoken_quote.executable is false, do not promise a fill.
stocktoken_metricsOperational metrics for this AI Agent Tokenized Stock OS process.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Operational metrics for this AI Agent Tokenized Stock OS process.
stocktoken_morpho_deposit_planBuild non-custodial ERC-4626 deposit plan (approve USDG + deposit) into Morpho Steakhouse Earn vault.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Build non-custodial ERC-4626 deposit plan (approve USDG + deposit) into Morpho Steakhouse Earn vault. Does NOT broadcast.
stocktoken_permit2_prepareOptional Permit2 helper.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Optional Permit2 helper. stocktoken_execute_plan already includes the Permit2 approval on a v4 route. Use this only when you are assembling a plan by hand.
stocktoken_policy_setUpdate session policy guardrails for AI Agent Tokenized Stock OS.No findings
Why it is in this group
- The name "stocktoken_policy_set" says "set": a word for a change.
Description, as the server wrote it
Update session policy guardrails for AI Agent Tokenized Stock OS.
stocktoken_session_createCreate a durable agent session with scoped permissions (persisted to DATA_DIR).No findings
Why it is in this group
- The name "stocktoken_session_create" says "create": a word for a change.
Description, as the server wrote it
Create a durable agent session with scoped permissions (persisted to DATA_DIR). Non-custodial.
stocktoken_session_updateUpdate limits/permissions on an existing session.No findings
Why it is in this group
- The name "stocktoken_session_update" says "update": a word for a change.
Description, as the server wrote it
Update limits/permissions on an existing session.
stocktoken_simulatePre-trade check on chain 4663: allowlist, policy limits, and whether the quote is executable.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Pre-trade check on chain 4663: allowlist, policy limits, and whether the quote is executable. This is not an eth_call of the swap. Pro required. If executable is false, stop and do not promise a fill.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
stocktoken_subscribe_planBuild non-custodial ETH subscription plan (tier pro|team, or custom ethAmount).No findings
Why it is in this group
- The name "stocktoken_subscribe_plan" says "subscribe": a word for a change.
Description, as the server wrote it
Build non-custodial ETH subscription plan (tier pro|team, or custom ethAmount). Pays treasury on chain 4663.
stocktoken_tip_assetsWhat the AATOS tip wallet can accept: native ETH + any ERC-20 on Robinhood Chain 4663; optional native BTC address if configured.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
What the AATOS tip wallet can accept: native ETH + any ERC-20 on Robinhood Chain 4663; optional native BTC address if configured.
stocktoken_tip_planBuild OPTIONAL tip plan.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Build OPTIONAL tip plan. asset=ETH (default) | BTC | registry symbol (USDG,WETH,NVDA,…) | 0x token. amount or ETH preset. User must confirm. Never coerce.

Only reads 18Looks things up and changes nothing.Claude Code: allow

stocktoken_access_pricingList Free / Pro / Team pricing (ETH on-chain, no Stripe) and how agents pay for write tools.No findings
Why it is in this group
- The description's first verb is "list": a word for reading.
Description, as the server wrote it
List Free / Pro / Team pricing (ETH on-chain, no Stripe) and how agents pay for write tools.
stocktoken_access_statusCheck paid access for current API key context or a wallet owner.No findings
Why it is in this group
- The name "stocktoken_access_status" says "status": a word for reading.
Description, as the server wrote it
Check paid access for current API key context or a wallet owner.
stocktoken_basket_previewPreview basket prices only.No findings
Why it is in this group
- The name "stocktoken_basket_preview" says "preview": a word for reading.
Description, as the server wrote it
Preview basket prices only. This does not swap and it is not a vault deposit. For one Stock Token, use stocktoken_quote then stocktoken_execute_plan.
stocktoken_feesSummarize disclosed AATOS execution fee events and on-chain monetization status (treasury / ETH fees).No findings
Why it is in this group
- The description's first verb is "summarize": a word for reading.
Description, as the server wrote it
Summarize disclosed AATOS execution fee events and on-chain monetization status (treasury / ETH fees).
stocktoken_find_poolsScan Uniswap v3 pool addresses only.No findings
Why it is in this group
- The name "stocktoken_find_pools" says "find": a word for reading.
Description, as the server wrote it
Scan Uniswap v3 pool addresses only. This is not a fill check and it does not see v4. For a swap, use stocktoken_quote then stocktoken_execute_plan.
stocktoken_getGet metadata for one canonical Stock Token or core asset by symbol (e.g.No findings
Why it is in this group
- The name "stocktoken_get" says "get": a word for reading.
Description, as the server wrote it
Get metadata for one canonical Stock Token or core asset by symbol (e.g. NVDA) or contract address on Robinhood Chain 4663. Use to verify a token is official before trading.
stocktoken_listList canonical Stock Tokens, ETFs, USDG, and WETH on Robinhood Chain 4663.No findings
Why it is in this group
- The name "stocktoken_list" says "list": a word for reading.
Description, as the server wrote it
List canonical Stock Tokens, ETFs, USDG, and WETH on Robinhood Chain 4663. Use this before trusting any address. Do NOT use for US brokerage equities (use Robinhood Trading MCP). Only registry addresses are real tokenized stocks.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
stocktoken_morpho_positionRead a wallet's Morpho Earn (steakUSDG) share balance and underlying USDG on chain 4663.No findings
Why it is in this group
- The description's first verb is "read": a word for reading.
Description, as the server wrote it
Read a wallet's Morpho Earn (steakUSDG) share balance and underlying USDG on chain 4663.
stocktoken_morpho_statusMorpho / Robinhood Earn status on chain 4663: Steakhouse USDG vault address, live TVL, share price.No findings
Why it is in this group
- The name "stocktoken_morpho_status" says "status": a word for reading.
Description, as the server wrote it
Morpho / Robinhood Earn status on chain 4663: Steakhouse USDG vault address, live TVL, share price.
stocktoken_policy_getGet current AI Agent Tokenized Stock OS agent policy (max notional, slippage, simulate-first, kill switch).No findings
Why it is in this group
- The name "stocktoken_policy_get" says "get": a word for reading.
Description, as the server wrote it
Get current AI Agent Tokenized Stock OS agent policy (max notional, slippage, simulate-first, kill switch).
stocktoken_priceRead the Chainlink USD price and ERC-8056 uiMultiplier for one registry token on chain 4663.No findings
Why it is in this group
- The description's first verb is "read": a word for reading.
Description, as the server wrote it
Read the Chainlink USD price and ERC-8056 uiMultiplier for one registry token on chain 4663. This is not a swap quote and not a brokerage quote. Use stocktoken_quote when you need amountOut.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
stocktoken_protocolsReturn Uniswap Universal Router, PoolManager, WETH, USDG, and feed source metadata for Robinhood Chain 4663.No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it
Return Uniswap Universal Router, PoolManager, WETH, USDG, and feed source metadata for Robinhood Chain 4663.
stocktoken_session_listList agent sessions, optionally filtered by owner.No findings
Why it is in this group
- The name "stocktoken_session_list" says "list": a word for reading.
Description, as the server wrote it
List agent sessions, optionally filtered by owner.
stocktoken_subscription_statusCheck on-chain subscription status for a wallet (requires SUBSCRIPTION_REGISTRY_ADDRESS when deployed).No findings
Why it is in this group
- The name "stocktoken_subscription_status" says "status": a word for reading.
Description, as the server wrote it
Check on-chain subscription status for a wallet (requires SUBSCRIPTION_REGISTRY_ADDRESS when deployed).
stocktoken_subscription_tiersList AATOS on-chain subscription tiers (paid in ETH to treasury).No findings
Why it is in this group
- The description's first verb is "list": a word for reading.
Description, as the server wrote it
List AATOS on-chain subscription tiers (paid in ETH to treasury). No Stripe.
stocktoken_system_statusFull system status: secrets, venues, chain, version, session count, fees.No findings
Why it is in this group
- The name "stocktoken_system_status" says "status": a word for reading.
Description, as the server wrote it
Full system status: secrets, venues, chain, version, session count, fees.
stocktoken_tip_presetsList optional tip presets (ETH) and what assets the tip wallet accepts (ETH, any ERC-20 on 4663, optional native BTC).No findings
Why it is in this group
- The description's first verb is "list": a word for reading.
Description, as the server wrote it
List optional tip presets (ETH) and what assets the tip wallet accepts (ETH, any ERC-20 on 4663, optional native BTC). Tips never required.
stocktoken_value_holdingsRead balances.No findings
Why it is in this group
- The description's first verb is "read": a word for reading.
Description, as the server wrote it
Read balances. This does not quote or swap. For a trade, use stocktoken_quote then stocktoken_execute_plan.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http aatos https://aatos.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__aatos__stocktoken_access_pricing",
      "mcp__aatos__stocktoken_access_status",
      "mcp__aatos__stocktoken_list",
      "mcp__aatos__stocktoken_get",
      "mcp__aatos__stocktoken_price",
      "mcp__aatos__stocktoken_value_holdings",
      "mcp__aatos__stocktoken_policy_get",
      "mcp__aatos__stocktoken_session_list",
      "mcp__aatos__stocktoken_protocols",
      "mcp__aatos__stocktoken_fees",
      "mcp__aatos__stocktoken_subscription_tiers",
      "mcp__aatos__stocktoken_subscription_status",
      "mcp__aatos__stocktoken_tip_presets",
      "mcp__aatos__stocktoken_morpho_status",
      "mcp__aatos__stocktoken_morpho_position",
      "mcp__aatos__stocktoken_basket_preview",
      "mcp__aatos__stocktoken_find_pools",
      "mcp__aatos__stocktoken_system_status"
    ],
    "ask": [
      "mcp__aatos__stocktoken_access_checkout",
      "mcp__aatos__stocktoken_access_activate",
      "mcp__aatos__stocktoken_policy_set",
      "mcp__aatos__stocktoken_quote",
      "mcp__aatos__stocktoken_simulate",
      "mcp__aatos__stocktoken_execute_plan",
      "mcp__aatos__stocktoken_session_create",
      "mcp__aatos__stocktoken_session_update",
      "mcp__aatos__stocktoken_subscribe_plan",
      "mcp__aatos__stocktoken_tip_assets",
      "mcp__aatos__stocktoken_tip_plan",
      "mcp__aatos__stocktoken_metrics",
      "mcp__aatos__stocktoken_morpho_deposit_plan",
      "mcp__aatos__stocktoken_morpho_withdraw_plan",
      "mcp__aatos__stocktoken_intent_typed_data",
      "mcp__aatos__stocktoken_permit2_prepare",
      "mcp__aatos__stocktoken_liquidity_matrix",
      "mcp__aatos__stocktoken_explain_routing"
    ],
    "deny": [
      "mcp__aatos__stocktoken_session_kill"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as aatos. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/dev.aatos/aatos/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

19 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry. Synced Oct 21, 2026, 18:11 UTC.

For agents: Markdown · JSON · report this listing