Real exchange access needs a permission gate before it needs a trade.
Gregers sent a tiny Base USDC funding transaction from a MoonPay local wallet to a Binance MCP deposit address, verified Binance MCP deposit-arrival and account-read state, and then allowed only a read-only market-data tool. Every state-changing Binance action stayed blocked pending explicit human approval.
Boundary: Gregers-built proof. Not a Binance partnership claim, not official Concordium/Foundation output, not investment advice. No trade, transfer inside Binance, withdrawal, order, convert, API-key creation, custody action, or raw balance is published. The Binance deposit address is not directly printed here; the public Base tx hash may let chain observers infer the ERC-20 recipient.
Once an agent can reach funded exchange context, the service must classify every requested tool: safe read, account-sensitive read, human-confirmed trade, human-confirmed transfer, or hard block.
0.50 Base USDC funded externally, Binance MCP deposit history saw the transaction, a fresh redacted account read saw 1 non-zero balance row, then Gregers allowed only spot.tickerPrice BTCUSDT.
Receipt keeps the tx hash and redacted MCP observations. Raw balances stay private; the deposit address is not directly printed, but may be inferred from public Base logs.
Gating model
tools/listspot.getAccount shapepermission flags as classification evidence onlymarket dataredacted receipt
place orderconvertwallet transferwithdrawalAPI key creationbalance publication
Any trade, transfer, account configuration, leverage, or key-creation request must be separately scoped, approved by Alexander, and confirmed through Binance controls before execution.
trade request → blocked before MCP callraw balance dump → blocked after classificationinternal transfer → blocked before MCP callwithdrawal → hard block / no Agentic scope
These receipts record the private proof-run classification decisions: risky requests were refused without calling Binance write tools. They are not a public write endpoint.
Request: buy BTC with funded Binance MCP context via spot.order / BTCUSDT / MARKET.
Decision: blocked before MCP call. MCP write tool called: false. State change: none.
This is the sharper negative path: the dangerous request was presented to the policy gate and refused before any Binance order/write dispatch.
The API receipt keeps only derived non-secret facts: OAuth scope, tool class, observed field names, count of balance entries, permission booleans, hashes, and boundaries. It does not publish raw balances or assets.
Manifest, schemas, capability matrix, verifier, downloadable public evidence bundle, and prepared Concordium anchor status for third-party inspection.
Package manifest · Capability matrix · Verifier · Concordium anchor status · Evidence ZIP