BONDED

Binance Agent OS ยท Trading Workflows

Going around it is possible. Unnoticed is not.

An AI agent trading your Binance account gets no credential - only a mandate. Every order that reaches the exchange is reconciled against what was actually authorised, so an order the gate never approved is detected, attributed, and stops trading.

View on GitHub Read the docs
The gap

Binance guarded one path. Agents use the other.

Agent OS offers two ways for an agent to trade an account, and only one of them has a human in it.

Guarded

MCP Server

Binance already fences this path, thoroughly.

  • Runs inside a dedicated Agentic sub-account
  • Withdrawal scope never available
  • Every trade confirmed by you first
Unguarded

Skills Hub & binance-cli

Takes raw API keys. This is the path that runs unattended.

  • Raw BINANCE_API_KEY and secret
  • No confirmation step
  • No sub-account isolation
How it works

Three parts, and only one of them is new.

A gate is table stakes. Reconciling against the exchange's own record is the part nobody else builds.

01

Mandate

Symbol allowlist, order types, sides, max notional, max open orders, loss and drawdown limits, trading window, expiry. Validated, grounded against live exchangeInfo, then hashed - so every audit record cites one exact ruleset and the rules cannot be widened behind the trail.

02

Gate

A pure function of mandate, order and exchange state - no I/O, no clock reads. Seventeen clauses in a fixed order, failing closed on anything it cannot evaluate. Denials name the clause that fired, so an agent corrects itself instead of retrying blindly.

03

Reconcile

The gate is blind to anything that goes around it. So BONDED keeps a second, independent account of reality - Binance's own order history - and treats disagreement as the finding. Anything it never authorised burns the bond and revokes trade scope.

Reconciliation

Five outcomes, and the differences matter.

Anything but the first burns the bond and stops trading.

AUTHORISED

Executed exactly as authorised.

MISMATCHED

Authorised - but the order that executed is not the one authorised.

FOREIGN

No BONDED identifier at all. A plain bypass.

FORGED

Wears BONDED's namespace without a valid tag - worse than foreign, because it is an attempt to look authorised.

UNKNOWN_AUTHENTIC

Valid tag, no matching record. A log-integrity problem.

Built on Agent OS

Remove Binance and there is nothing to guard. Every surface BONDED uses is one Agent OS shipped, and it composes with the rest: register Binance's own MCP server for market data and BONDED for orders, and the agent reads from Binance and writes through the mandate.

Skills Hub Packaged as an installable skill
binance-cli Official tooling, reads reference prices
MCP An MCP server itself, beside Binance's
Spot REST Signed orders, filters, order history
Roadmap

What comes next.

Three pieces, in the order they are worth building. Each is scoped work rather than an aspiration, so the reason it is not done yet is stated with it.

  1. Next

    Restore real-time detection

    Binance removed the listen-key endpoints in February 2026, so the account-wide stream is gone and polling is the only source. Migrating to userListenToken brings detection back from one poll interval to near-instant, and restores coverage of symbols outside the mandate.

  2. Then

    Futures and margin

    Not a bigger clause set - a different one: leverage, liquidation distance, funding, reduce-only, position side. Drawdown would have to bind on unrealised PnL rather than realised, and reconciliation needs a sixth outcome, because a liquidation moves a position with no order behind it to match.

  3. Later

    Move the key out of reach

    Signing inside an enclave or against an HSM, so compromising the host no longer compromises the credential. This raises the rung on the ladder rather than removing the ladder: trust moves to attestation instead of to the machine.