How the locker works.

MCP setup

Three steps. You need Node 22 or newer on the agent's machine and a wallet on Robinhood Chain for yourself.

1. On the agent's machine, create its key: . It prints the agent address and keeps the key in ~/.orbio-locker/agent.json. The key never leaves that machine.
2. In the app, open a locker and paste that address with its limits (or add it later with Add agent). Send it a little ETH for gas with the grant.
3. Add the MCP server to your client with your locker address in LOCKER_VAULT.

Claude Desktop

In claude_desktop_config.json:

Claude Code

Environment

Any MCP client works the same way: run with these variables. It needs Node 22 or newer. orbio-locker doctor checks the setup.

Agent tools

The server gives the agent five tools. Only one of them sends a transaction, and that transaction can only be trade() on your locker.

What the contract enforces

The agent key can call one function, trade(path, amountIn, minOut, deadline). Before any swap the locker checks, in order:

1. The caller is an agent of this locker, its key has not expired, and the locker is not paused or tripped.
2. The route is a Uniswap v3 path whose first and last tokens are both listed. The output always lands in the locker.
3. The locker books enough of the input token, no stock token in the trade is in a corporate action, and both Chainlink feeds are younger than their max age.
4. The trade's dollar value, at Chainlink, fits the agent's per trade limit and what is left of its daily limit (a UTC day).
5. The swap must return at least the Chainlink-implied amount less the agent's max slippage, whatever minimum the agent asked for. Otherwise it reverts and nothing trades.
6. If the locker's unit price is below its drawdown stop, the call trips the locker instead of trading, and every agent stops until you re-arm it.

So the worst a rogue agent can do in a day is about its daily limit times its max slippage, leaked to bad prices. It can never withdraw, transfer, approve or call anything else.

Limits written in the contract: at most tokens and agents per locker, max slippage up to , a drawdown stop up to , a feed max age up to , a protocol fee up to .

Refusal reasons

The locker's preview() returns one of these codes before a trade, and trade() reverts with Refused(code). The MCP server shows the words.

Owner actions

• Deposit ETH (wrapped to WETH) or any listed token (approve first). Anyone may deposit; only you can take out.
• Withdraw any amount of any token, or ETH from WETH. Never needs a price.
• Pull everything out (exit): pause and send every listed token's whole balance to you, skipping a token that refuses.
• Add agent, edit limits, revoke (grant, revoke), with optional ETH for the agent's gas.
• Pause and unpause, set the drawdown stop (restarts the peak), re-arm after a trip.
• List and unlist tokens (unlist only with none booked), sync tokens sent to the locker directly.

Risks and limits

• Not audited. The contracts have unit tests and a fork test against the real pools and feeds, but no audit. Start small.
• No upgrade path. Nobody can change a locker's code, fix a bug in it or add features to it.
• Weekend feeds. Chainlink stock feeds stop when markets close. A stale answer is accepted up to the max age you set (4 days for stocks by default), so on a Monday the oracle price can lag the market and the floor protects less.
• You pick the feeds. The app proposes the official Chainlink feed for each token; a locker listed with another feed is unranked on the board.
• Market risk. The floor stops bad fills, not bad ideas: an agent can buy something that falls. The drawdown stop is what caps that.
• Dependencies. Trades need Uniswap v3 on Robinhood Chain and the Chainlink feeds. Withdrawals and exit need neither.
• Protocol fee. The factory admin can set a fee of at most 0.2% of each agent trade, paid in the input token. It starts at 0.
• The agent's machine. Whoever gets the agent key gets the agent's limits, no more. Revoke a key you think leaked.

FAQ