CO-PILOT · TWO DOORS, ONE PLAN FORMAT
Agents propose. Owners sign.
A plan is a link. It carries no key, your browser re-reads every number from the chain before anything can be armed, and each signature is yours, one at a time.
Read tools9same reads as the app
Plan tools3order, funds, launch
Sign tools0no key parameter
Signer allowlist8actions, unchanged
In the app
no install · Ctrl K on any screenRead aslaunchDoor B, bring a tokenfrom baseBase0x9401…8631a token on Base, read on the plan page
Signatures16 to listBase 4 · HyperEVM 2 · Hyperliquid 10
Signers5 rolesCore owner, EVM deployer, OApp owner, Source deployer, Finalizer; one wallet may hold several
TickerGASthe auction priceread on the plan page · floor 500.0 HYPE
Other chainsGASat each signatureBase in ETH, HyperEVM in HYPE, quoted before you sign
Liquid SpotLIQUID SPOT FEEnonewe charge nothing to deploy (ADR-0020)
LocksFINAL5 stepsticker, genesis, pair, link, listing; link permanence [Verify]
Fixed grammar · no AI call · nothing read until the plan page
Where the token travels in this plan
BASE
BASELayerZero delivery
EVM
EVMsame L1 block
SPOT
SPOTafter listing
BOOK
Also understood
move 500 usdc from arbitruma Funds plan, ranked by what lands in spot
plan a 10k buy of HFUNan order plan with the cost probe
Open plansha256 printed on the plan page, after its reads
Your own agent
local MCP server · read and plan toolsNOT ON NPM YET~/agent $ npx liquidspot-mcp
liquidspot-mcp · stdio · 9 read tools · 3 plan tools
no key parameter · no sign tool
agent → plan_launch
{
"source": "base",
"token": "0x940181a94A35A4569E4529A3CDfB74e38FD98631",
"preset": "bridged",
"extra_decimals": 12 set by the agent
}
liquidspot-mcp ←
plan Door B · LayerZero · 16 signatures to list
ticker GAS 500.0 HYPE, live auction price
fee LIQUID SPOT FEE none
hash sha256 21cc2650172b32ed…4d1b936ca7bc
470-character fragment · a human opens it
Add it to your agent
{ "mcpServers": { "liquidspot": { "command": "npx", "args": ["liquidspot-mcp"] } } }
RunsOn your machine, over stdio, built on packages/hl (ADR-0001). Nothing to sign up for.
HoldsNo wallet and no key. There is no parameter to pass one.
ReturnsA typed plan, its sha256 and a link: /plan# for a launch. A human opens the link.
ShipsRead tools, plan links and Ctrl K in Phase 3 (ADR-0044); plan_launch for Door B in Phase 4, after the audited templates. Not on npm yet: from a checkout, node packages/mcp/bin/liquidspot-mcp.mjs.
/AGENTS
What an agent can and cannot do
The same page agents read before they connect. Every line is a rule in code or an ADR, not a promise.Read tools9
xray_impactwhat a size costs on the book, average and worst
xray_counterpartywho sat on the other side of recent prints
xray_compositionwho holds the depth that moves the price 1%
deployer_moveswhat the deployer and genesis wallets did lately
seatbeltthe 8-cell Seatbelt grid, blanks with their reasons
venue_comparebook against the HyperEVM route at one size
funds_routesways in, ranked by what lands in spot
launch_statusthe step a ticker has reached, from chain reads
auction_nowthe live ticker auction price and end time
Plan tools3
plan_orderan order with its cost probe; the ticket confirms it
plan_fundsa way in or out, every take named
plan_launcha Launch Studio plan, every signer and lock listed
Signer allowlist8, unchanged
ordermodifybatchModifycancelcancelByCloidtwapOrdertwapCancelscheduleCancel
The trading worker signs only these (apps/web/src/trading/agent/protocol.ts). Agents add nothing to it; a launch signs with the owner's wallet.NeverAn approved agent cannot move funds anyway: agentSendAsset requires the destination to equal the source (Hyperliquid exchange endpoint docs) [Verify].
No key
No sign tool
No sending without the confirm
Nothing on a timer
No retries
Who holds the key when an agent trades
A hosted MCPmay trade with an API wallet key that the service stores
A local scriptmay read a raw private key from the agent’s machine
Liquid Spotnobody: an agent gets plans, never a key
[Verify]Whether an approved API wallet may sign spotDeploy is undocumented. Free testnet probe: an agent-signed no-op userGenesis. Even if it passes, a launch-scoped agent needs its own ADR.