Connect Codex to your broker through BotSpot

BotSpot capabilities

1. Understand the three-layer connection

Codex is the MCP client. BotSpot supplies the authenticated tools and workflow. A supported broker holds the account and executes eligible orders.

Connect the brokerage account inside BotSpot first. Do not paste broker credentials into Codex, a prompt, a repository, or config.toml.

• Codex to BotSpot: Streamable HTTP MCP.
• Codex authentication: BotSpot API key sent as a bearer token.
• BotSpot to broker: saved BotSpot broker connection.
• Execution: subject to BotSpot approval, broker support, account permissions, and order eligibility.

2. Create a BotSpot key and configure Codex

Create a BotSpot API key from Account Settings, store it in the BOTSPOT_API_KEY environment variable, then add the BotSpot server to Codex configuration.

Use ~/.codex/config.toml for this host or .codex/config.toml inside a trusted project. Never commit the API key or write its value directly into the TOML file.

• [mcp_servers.botspot]
• url = "https://mcp.botspot.trade/mcp"
• bearer_token_env_var = "BOTSPOT_API_KEY"

3. Verify with a read-only request

Restart the Codex client after changing MCP configuration. Run codex mcp list from the CLI or use /mcp inside Codex to confirm BotSpot is connected.

Start with a narrow prompt such as: “List my BotSpot strategies and latest backtests. Do not create, edit, deploy, or trade.” Verify returned account context before allowing write-capable work.

• A 401 response usually means the BotSpot API key was not loaded, expired, or was revoked.
• If BotSpot is missing, confirm the full endpoint ends with /mcp.
• If tool definitions changed, restart Codex so it reloads the MCP catalog.

4. Add a conservative Codex approval policy

OpenAI documents per-server tool approval controls. Add default_tools_approval_mode = "writes" under the BotSpot MCP server when you want Codex to prompt before tools not marked read-only.

Codex approval does not replace BotSpot trade approval. It adds a client-side checkpoint before BotSpot creates the pending action.

• default_tools_approval_mode = "writes"
• Use enabled_tools or disabled_tools only when you intentionally want a narrower tool surface.
• Do not configure blanket approval for write-capable trading tools.

5. Connect a supported broker inside BotSpot

Current BotSpot support includes stock, options, futures, and crypto connections. Support means BotSpot can connect to the listed provider; it does not prove that every account can place every order.

• Stocks and options: Alpaca, Charles Schwab, and Tradier.
• Futures: Tradovate and TopstepX.
• Crypto: Alpaca, Kraken, Coinbase, WEEX, and Bitunix.
• Paper mode is available only for listed broker and authentication combinations.
• Broker permissions, market data, regions, fees, products, and order types remain account- and broker-specific.

6. Stage a trade without bypassing approval

Ask Codex for a concrete symbol, side, quantity, order type, time in force, and required prices. When the place_trade tool is available, BotSpot validates the request and creates a pending high-risk action.

Review the short-lived BotSpot authorization page while signed in. Confirm broker, paper or live mode, symbol, quantity, order type, prices, option legs, and exits before approving.

Do not treat creation of the approval as execution. Use BotSpot status or get_single_trade_status after approval before claiming the order was submitted, filled, rejected, or canceled.

7. Know when direct trading is unavailable

Direct trading depends on the place_trade scope being present for the current BotSpot API key and MCP session. A deliberately restricted token may expose research and account tools without exposing trade creation.

Broker adapters can also reject unsupported order classes, account permissions, time-in-force values, or product combinations. BotSpot reports those failures without returning broker secrets.

Safe starter prompts

• “List my supported BotSpot broker connections and identify paper versus live mode. Do not change anything.”
• “Show my latest completed backtests and summarize their assumptions. Do not start a new backtest.”
• “Prepare a one-share market buy of SPY using an eligible paper connection. Stage it for BotSpot approval; do not claim it executed.”
• “Check the status of the pending trade action. Report only confirmed approval and broker status.”

Limitations and risk

MCP configuration proves connectivity, not trading readiness. Generated analysis can be wrong, backtests remain simulations, and broker execution can differ because of prices, fills, latency, liquidity, fees, permissions, outages, and changing market conditions.

Start with read-only inspection and paper mode where supported. Review every credential scope, order payload, approval screen, and status result.

Frequently asked questions

Sources

• Official OpenAI Codex MCP documentation
• BotSpot MCP for Agents
• BotSpot broker connection manifest
• BotSpot supported brokers
• BotSpot platform comparison
• BotSpot Terms of Service

Sources verified 2026-08-14.