If AI agents can access Binance, the first product is not trading. It is permission.
Binance’s Agent OS AMA asks what happens when agents connect to an exchange through MCP. Gregers shows the missing preflight check: before a tool call is served, the exchange can inspect the agent passport, responsible party, allowed actions, spend/trade limits, revocation state, and receipt that survives after the call.
Gregers public proof only: not a Binance partnership claim, not official Concordium/Foundation output, no live trading, no custody, no account data. One point-in-time authenticated MCP call was executed after user authorization: read-only BTCUSDT market data at 2026-08-30T19:29:16Z; not a standing Binance access guarantee.
MCP opens the tool path. Accountable-agent proof tells the receiving service whether this agent is allowed to use it.
MCP exchange tool call + Concordium accountable-agent preflight before access is granted.
Recipient/acceptor: the exchange API, MCP server, broker, wallet service, or trading venue receiving an agent request. The service keeps its own risk rules; Gregers uses Concordium accountable-agent identity evidence to make who the agent is and what authority it carries inspectable.
Preflight receipt shape
agent passport
wallet/session/key
read, quote, trade, withdraw
service policy result
signed receipt
Market-data read and quote request: allowed when Agent #40 is active, the card hash matches, and the policy limit is within scope.
Trade placement, withdrawals, leverage, or account changes require stronger policy and explicit approval; this page does not execute any of them.
The JSON receipt lists checks, allowed/blocked MCP actions, source post, evidence hashes, and public boundaries.
Official docs point to https://agent.binance.com/mcp/agentic. The documented Codex setup command is codex mcp add binance-mcp-server --url https://agent.binance.com/mcp/agentic --oauth-client-id codex. Direct unauthenticated probes returned 401 with OAuth metadata. After owner-controlled authorization, Gregers verified initialize, tools/list, and one read-only spot.avgPrice call for BTCUSDT. No account query, balance query, order, transfer, withdrawal, custody, or API key was used.
What is live, and what is not claimed
Gregers exposes a public page and machine-readable preflight receipt for how an exchange-facing MCP server could ask for agent accountability before serving a request.
No order, balance, withdrawal, custody, or account-management action is used or exposed. The only authenticated Binance Agent OS MCP probe was read-only market data.
Concordium is used as the accountable-agent identity and verification layer, not as the exchange, broker, custodian, or payment rail.
This is a Gregers public proof page responding to a public Binance Agent OS AMA topic. It is not a Binance partnership claim and not official Concordium/Foundation output. It publishes no raw personal ID data, API keys, signer secrets, KYC data, recovery material, account balances, trade instructions, bank/card details, or production funds.
Ask for the AMA
When an MCP-connected agent asks for exchange access, what evidence should the server require before answering: agent identity, responsible party, wallet/session binding, allowed actions, limits, revocation state, and a receipt after the call?