Security model

What the code enforces

• The model has no tool for transfers, withdrawals, cross margin or limit changes.
• All opens pass the risk engine; limits come from config, not from the prompt.
• Live mode requires --live and --i-understand-real-funds, and a valid HL_PRIVATE_KEY.
• The MCP server holds no key.

Key handling

• Use a Hyperliquid API wallet (agent wallet): it can trade but cannot withdraw. Set accountAddress to the master account.
• Keys are read from environment variables only and never written to the journal.
• Run on a machine you control. Do not commit .env.

Residual risk

• Market risk. Within the limits the agent can still lose all margin on every trade it takes.
• Prompt injection. The agent only ingests exchange data, but if you add tools that read the web or social feeds, treat that text as untrusted.
• Operator trust. A journal proves integrity, not honesty of the operator. See the journal limits.
• Software risk. No audit yet. Test on testnet and paper first.

Reporting vulnerabilities

Use GitHub private vulnerability reporting on the repository. Please do not open public issues for exploitable bugs.