PitBridge
Join the waitlist
ProductSafetyPricingCompareDocsOpen sourceLearnChangelogGitHub

AI trading agents need hard limits.

PitBridge lets your AI agent trade NinjaTrader 8 from your own machine, behind hard limits it cannot prompt its way past.

~/your-project
$ uvx pitbridge mcp
# no config? safe paper demo. fake account, 12 guardrails on, live locked.
Join the waitlistRead the safety model
PitBridge order pathAn order intent travels from the AI agent through the PitBridge daemon to the guardrail engine, which either allows it through to NinjaTrader 8 or blocks it with a stated reason.AI AGENTmcp / rest clientPITBRIDGE DAEMONlocalhost:8873GUARDRAIL ENGINE12 rules activeNINJATRADER 8Sim101ALLOW buy 2 MES. all rules pass.BLOCK buy 10 MES. size 10 > max_contracts_per_order 2.

Point the agent you already run at it.

PitBridge is a Model Context Protocol server, so it attaches to the agent runtimes vibecoders use every day. No new client to learn.

  • Claude Codemcp stdio

    one command adds the local server

  • Claude Desktop.mcpb

    one-click bundle, guardrails in settings

  • OpenClawskill

    the pitbridge-trading skill wraps the tools

  • Hermesmcp http, roadmap

    MCP over streamable HTTP is on the roadmap

  • Cursormcp stdio

    add pitbridge to mcp.json

  • Your own scriptrest / ws

    localhost REST and a WebSocket event feed

Copy-paste setup per runtime in the quickstart.

One bad tool call can fail an evaluation.

An AI agent that can place orders can also place the wrong one. A size typo, a stale context window, a tool call fired twice. On a prop evaluation account, one oversized order can end weeks of work. Telling the model to be careful is a prompt. A limit the software cannot cross is a control.

pitbridge audit tail
14:02:11  order.intent    buy 2 MES   agent=claude-desktop
14:02:11  guardrail.eval  max_contracts_per_order ok (2 <= 2)
14:02:11  order.allow     routed to NT8 Sim101
14:07:36  order.intent    buy 10 MES  agent=claude-desktop
14:07:36  guardrail.eval  max_contracts_per_order fail (10 > 2)
14:07:36  order.block     size 10 exceeds max_contracts_per_order 2

Example log with example config values.

Your agent proposes. The guardrails adjudicate.

The model can ask for anything. The verdict is computed by a deterministic engine that runs outside the model, in code the agent cannot reach.

Their MCP safety is prompt instructions. Ours is a deterministic engine outside the model.

model outputcan request anything
# the agent asks for two orders
place_order("MES", buy, qty=2)
place_order("MES", buy, qty=10)
engine verdictnot promptable
  • ALLOW buy 2 MES. all rules pass.
  • BLOCK buy 10 MES. MAX_CONTRACTS_PER_ORDER, limit 2.

Rules the agent cannot talk its way around.

Every rule is enforced in the daemon, outside the model. Each card shows a real decision format.

kill_switch

One command halts all order flow. Nothing passes until you re-arm it yourself.

BLOCK sell 1 RTY. kill_switch is armed.

max_contracts_per_order

Caps contracts per order. Oversized orders never reach the platform.

BLOCK buy 5 MNQ. limit is 2.

daily_loss_halt

When your configured daily loss is hit, new orders are refused for the rest of the day.

BLOCK buy 1 ES. daily loss 512 >= limit 500.

trading_window

Orders are accepted only inside the window you define.

BLOCK buy 1 CL at 03:12. window is 09:30-16:00.

instruments

The agent trades only the instruments you listed. Everything else is refused.

BLOCK buy 1 6E. not in allowlist.

max_orders

Caps orders per minute so a looping agent cannot spray the book.

BLOCK order 7 in 60s. limit is 6.

human_confirm

Live accounts require your explicit confirmation. Sim is the default.

WARN live order held. confirm to send.

Seven of the twelve. See every guardrail.

How an order travels.

Your agent proposes an order over MCP or the local REST API. The daemon receives it on localhost, runs it through the guardrail engine, and only then talks to NinjaTrader 8. Allowed orders route to your account. Blocked orders stop at the engine and the reason is logged. PitBridge cloud never sits in this path. It can receive telemetry if you opt in. It can never carry an order.

PitBridge architectureEverything on the order path, from the AI agent through the PitBridge daemon and guardrail engine to NinjaTrader 8, runs on your machine. PitBridge cloud sits on the internet, disconnected from the order path, and can only receive opt-in telemetry.your machineAI AGENTmcp / rest clientPITBRIDGE DAEMONlocalhost:8873GUARDRAIL ENGINE12 rules activeNINJATRADER 8Sim101ALLOW buy 2 MES. all rules pass.BLOCK buy 10 MES. size 10 > max_contracts_per_order 2.telemetry only, never ordersinternetPITBRIDGE CLOUDopt-in
solid = order path dashed = optional telemetry
PitBridge paired modeThe AI agent and the PitBridge daemon run on your Mac. The NT8 add-on and NinjaTrader 8 run on your Windows PC. Orders cross only your local network. The internet enclosure above is empty except for an opt-in telemetry stub, nothing else leaves your machines.internetopt-in telemetry, nothing else leavesyour macPITBRIDGE DAEMONguardrail engine insideAI AGENTmcp / rest clientyour windows pcNT8 ADD-ONws clientNINJATRADER 8Sim101local network
solid = order path dashed = optional telemetry

Daemon on your Mac, NinjaTrader on your Windows box.

NinjaTrader runs on Windows. Your agent tooling probably lives on a Mac. PitBridge is built for that split: the daemon runs on macOS, Windows, or Linux, and pairs with a small add-on inside NinjaTrader 8 over your local network. One machine or two, the rule is the same: orders move only between machines you own.

daemon
macOS, Windows, Linux
add-on
NinjaTrader 8 on Windows
link
local network, no cloud hop
Local-first trading bridge

Read the code that guards your account.

The daemon and the guardrail engine are open source under Apache-2.0. Audit the decision logic, run it fully offline, and file an issue when we are wrong. Safety is never behind a paywall.

12
deterministic guardrails, default-on
9
MCP tools, reads and writes
Apache-2.0
open core, read every line
0
cloud hops in the order path
safe by default
$ uvx pitbridge run --config ./config.toml
daemon up. mode=paper. guardrails=12 active. live=locked.
$ pitbridge arm-live
refused: no live provider in the open-source core. paper and sim only.
$ pitbridge audit verify
audit chain intact. 0 gaps, 0 edits.

A fresh install cannot place a live order. Unlocking live is an operator step at the command line. The agent has no tool for it.

View the source on GitHubRead the security model

Free to try. You pay when you go live.

The full guardrail engine, paper trading, and the audit log are free forever. Pro unlocks live execution and prop firm rule packs.

  • Free

    $0open core, forever

    Paper and read-only. The full guardrail engine.

    • All 12 guardrails, default-on
    • Paper and simulation trading
    • Hash-chained audit log
    • One account

  • Pro

    most popular

    $49per month

    Everything in Free, plus live execution.

    • Live-execution unlock
    • Prop-firm rule packs
    • Fan-out to about 5 accounts
    • Audit export

    Founder price $39 per month, locked for life, first 100 accounts.

  • Desk

    Plannedfor larger setups

    10+ accounts, multi-seat, priority support.

    • Everything in Pro
    • 10+ accounts
    • Multiple seats
    • Priority support

    Not available yet.

CrossTrade gates its MCP behind a $99 per month cloud plan (crosstrade.io/pricing, verified 2026-07-09). PitBridge speaks MCP for free, on your machine. You pay when you go live. See the full comparison.

Full pricing, founder terms, and the live-unlock FAQ.

What PitBridge is not.

  • not a signal service

    PitBridge never tells you what to trade. It has no opinion on the market.

  • not a strategy

    No entries, no exits, no edge. You bring the strategy and the agent. PitBridge enforces the limits.

  • not a profit promise

    Guardrails cap damage. They do not create returns, and they cannot guarantee you pass an evaluation.

  • not a compliance service

    PitBridge enforces the limits you configure. Reading and following your prop firm's rules stays your job.

  • not a cloud broker

    Orders never route through our servers. If pitbridge.com disappears tomorrow, your bridge keeps running.

Questions traders and builders ask first.

Is it safe to let an AI agent place orders?

It is as safe as the limits you put around it. PitBridge runs a deterministic guardrail engine outside the model. Order size caps, a daily loss halt, trading windows, an instrument allowlist, a rate limit, and a kill switch all run in code the agent has no tool to reach or weaken. A blocked order never leaves your machine, and every decision is written to a hash-chained audit log.

Does my data leave my machine?

No. The daemon runs on your own computer and talks to your agent over localhost. Orders, keys, and positions never route through a PitBridge server. If you enable telemetry it is opt-in and it can never carry an order. If pitbridge.com disappeared tomorrow, your bridge would keep running.

Can the agent turn off the guardrails or unlock live trading?

No. The guardrails live in a config file the agent cannot edit, and there is no tool to weaken a limit, release the kill switch, or arm live trading. A fresh install runs in paper mode only. Unlocking live execution is an operator step at the command line. This is tested against prompt injection, not just asserted.

How is this different from CrossTrade?

CrossTrade routes your orders through its cloud and gates its MCP behind a $99 per month plan, where safety on the agent path is largely instructions to the model. PitBridge is local-first with no cloud in the order path, its guardrails are a deterministic engine outside the model, and the MCP is free. See the full comparison.

PitBridge is in development. NinjaTrader 8 is first.

Tell us your platform and the agent you build with. We email you when your setup is supported. Nothing else.

We ask this to prioritize platforms. No sharing, no marketing list.

Answer a few more questions on the full form