Claude trading bot: coding agents, permissions and tests

Short answer: A Claude trading bot often means trading code written with Claude Code, a coding agent that reads files, runs commands and reaches the network, so the first risk is what the agent can touch and only then what it writes. Keep live keys off the machine it runs on, let it reach only a testnet, review what it proposes and take test cases from the exchange's documents. The agent can write the code; nothing shows that this makes a strategy profitable, and automated trading can lose money.

A chat window can hand you bad code. A coding agent can also run it, read your .env and call an exchange. This guide covers that difference from Claude Code's documents as read on 5 November 2026. Code faults and a test harness are in ChatGPT trading bot; exchange MCP servers are in crypto trading MCP servers.

Fincode has no affiliation with Anthropic. This guide describes one tool, ranks nothing and offers no strategies or prompt packs. The Python and Docker samples were run; the settings file is built from documented keys and was not run.

Why a Claude Code trading bot starts with permissions

The agent acts with your account's reach, so anything your user can read or call is in scope unless something stops it.

How to build a trading bot with Claude Code, in a safe order: write your rules and acceptance tests first; give the repository no secrets; run the agent in a container or sandbox that reaches only a testnet; start in Manual mode with claude --permission-mode default, since auto mode is the built-in interactive start from v2.1.283; review every diff; and deploy a reviewed commit from a separate host.

Keep live keys off the machine the agent runs on

A key that is not on the machine cannot be read, printed, committed or used by mistake, and no other control offers that.

Use testnet keys only where the agent runs, and create the live key on a separate host that receives reviewed code; API key security for trading bots covers storage and scoping. Do not count on auto mode to stop a live order: its documents list reading .env and sending credentials to their matching API as allowed by default, and neither the block nor the allow list read on 5 November 2026 mentions order placement or trading. This is a reading of the lists, not a test.

Deny rules, sandbox, container: what each one stops

Permission rules match what the command says, while a sandbox limits what the running process can do, and only the second is network enforcement.

No rule naming curl could match this test, since the program opens its own socket, but a network namespace does not care what the command says.

docker run --rm --network none python:3.12-slim python -c "
import socket
try:
    socket.create_connection(('testnet.binance.vision', 443), timeout=5)
    print('connected')
except OSError as e:
    print(type(e).__name__, e)"

Output on 5 November 2026: gaierror [Errno -3] Temporary failure in name resolution. The same command without --network none printed connected.

A starting point follows; swap the host for your venue's documented test host. The documents say strictAllowlist has no effect in a repository's settings, so pass this file with claude --settings or put it in your user settings. They also warn that the proxy trusts the client-supplied hostname, so keep the list narrow. Without failIfUnavailable, a platform that cannot sandbox runs commands unsandboxed, as native Windows does.

{
  "permissions": {
    "deny": ["Read(.env)", "Read(.env.*)", "Read(secrets/**)",
             "Edit(./tests/acceptance/**)", "Edit(./guard.py)"],
    "ask": ["Bash(git push *)"]
  },
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "allowUnsandboxedCommands": false,
    "network": {
      "allowedDomains": ["testnet.example-venue.test"],
      "strictAllowlist": true
    }
  }
}

Masking is no shortcut either: the sandbox can show commands a placeholder and swap in the real value on outbound requests, but only with experimental TLS termination, and the documents describe re-signing only for AWS. A request signed locally with HMAC would carry a signature made with the placeholder, so expect rejection; that is reasoning, not a test.

Testnet-only environment variables

A startup guard stops honest mistakes, such as a stale .env, but it is a seat belt and not a boundary, because an agent can edit it.

import os

TEST_URLS = {"https://testnet.example-venue.test"}  # your venue's documented test URL

def require_test_environment(env=os.environ):
    url = env.get("BOT_BASE_URL", "")
    if url not in TEST_URLS:  # exact match, no parsing
        raise SystemExit(f"refusing to start: {repr(url)} is not a test URL")
    if env.get("BOT_LIVE_KEY"):
        raise SystemExit("refusing to start: a live key is in this environment")
    return url

for env in ({"BOT_BASE_URL": "https://testnet.example-venue.test"},
            {"BOT_BASE_URL": "https://api.example-venue.test"},
            {"BOT_BASE_URL": r"https://api.example-venue.test\@testnet.example-venue.test"},
            {"BOT_BASE_URL": "https://testnet.example-venue.test", "BOT_LIVE_KEY": "x"}):
    try:
        print("started on", require_test_environment(env))
    except SystemExit as stop:
        print(stop)

Output on Python 3.11.3, 5 November 2026:

started on https://testnet.example-venue.test
refusing to start: 'https://api.example-venue.test' is not a test URL
refusing to start: 'https://api.example-venue.test\\@testnet.example-venue.test' is not a test URL
refusing to start: a live key is in this environment

Matching the whole string is deliberate: on 5 November 2026, Python's urlparse read the third URL as the test host, while requests 2.31.0 parsed it as api.example-venue.test. The settings file above denies edits to this guard and the acceptance tests; review diffs that touch them anyway. The check only catches names you listed, and the documents say there is no built-in credential deny list either, so name secrets under sandbox.credentials.

Reviewing before approval: who stays responsible

No mode moves the loss to anyone else, as Claude Code's security page says:"You're responsible for reviewing proposed code and commands for safety before approval."

• Saved approvals outlast the moment. Choosing "Yes, and don't ask again" for a Bash command saves a rule for that repository in later sessions. Approving python bot.py that way pre-approves it next week, whichever key is then in place. Audit with /permissions.
• Automatic approval changes the reviewer, not the owner. A classifier reviews in your place. Boundaries you state in chat are not stored as rules and can be lost to context compaction, so the documents point to deny rules for a hard guarantee.
• Exchange terms can reach your AI provider's terms. OKX's API Agreement (last updated 28 July 2026), section 8.3(c), says that if an AI provider's terms restrict a use, including fully automated trading without human oversight, you must not implement it through the API.
• The provider's policy has a line to read. Anthropic's Usage Policy, showing an effective date of 12 November 2026, treats a personalized recommendation to buy, sell or hold specific investment products as a high-risk use needing a qualified human reviewer, and excludes applying a fixed rule where the model exercises no judgment. Recheck after that date; this is not legal advice.

Trading bot Claude skills and paste-in setup prompts

Treat a third-party trading bot skill, a repository's rule file or a paste-in setup prompt as code you are installing, because that is what it does.

Anthropic's Agent Skills overview says to use skills only from trusted sources, meaning ones you created or obtained from Anthropic, warns that a malicious skill can direct tool calls that do not match its stated purpose, and says that in Claude Code skills have the same network access as any other program. Before a repository from a claude trading bot github search gets near your machine, read these:

A prompt that tells your agent to clone a repository, install it and edit your config runs someone else's instructions under your permissions, so run those steps yourself after reading them. This guide lists no such repositories; stars say nothing about safety.

Tests the agent writes share its misunderstandings

A test written from the same assumption as the code passes for the same wrong reason, so take test cases from the exchange's documents and data.

Here the rounding function and its test agree, and only a check copied from Binance's filter document exposes the assumption (a typical pattern, hand-written and run on 5 November 2026):

from decimal import Decimal as D

def round_qty(qty):
    return round(qty, 3)             # assumes three decimals on every symbol

assert round_qty(12.34567) == 12.346 # a test from the same assumption passes

def lot_size_ok(qty, f):             # conditions copied from the filter docs
    q, low, high, step = (D(str(x)) for x in
                          (qty, f["minQty"], f["maxQty"], f["stepSize"]))
    return low <= q <= high and q % step == 0

for step in ("0.00001", "0.01", "1"):   # step sizes seen in exchangeInfo
    f = {"minQty": step, "maxQty": "9000", "stepSize": step}
    print(step, round_qty(12.34567), lot_size_ok(round_qty(12.34567), f))

Output:

0.00001 12.346 True
0.01 12.346 False
1 12.346 False

Write acceptance tests before the agent starts, with each expected value traced to a dated document, and deny edits to that folder as in the settings above. The auto mode list covers force-passing tests that guard security behavior, which a trading test may not be. Failure cases to include are in the harness guide, and limits belong outside the strategy, as trading bot risk management explains. Tests show how software behaves, not future results. For an outside review, see Fincode's trading bot code review, which is not a neutral pointer; naming Binance or OKX here does not mean Fincode integrates them or has built on them.

Rules depend on your jurisdiction and each exchange's terms, and naming a platform is not a recommendation. For readers in Turkey, Article 99/A of Capital Markets Law No. 6362 treats activity by foreign crypto-asset platforms directed at Turkish residents as unauthorized.

Frequently asked questions

Can Claude build a trading bot?

It can write the code from rules you give it. You still own the rules, the review, the tests and every order, and nothing shows that the code makes a strategy profitable.

Is it safe to run Claude Code on a machine with exchange keys?

Avoid it. Without the sandbox, deny rules do not stop a script that opens the file, and hooks and MCP servers run outside the sandbox. Keep live keys on a separate host.

Does auto mode make a coding agent safe for trading code?

No. It replaces your review with a classifier, and the documents say it does not guarantee safety.

What is a trading bot Claude skill?

A folder of instructions and scripts the agent can load. Anthropic says to use skills only from trusted sources, so read every file in a third-party one first.

Can Claude place trades on my account?

Only through a tool, script or server that holds your credentials or a token, and anything with trade permission can act on a prompt injection. Keep testnet keys in development and read the guide on crypto trading MCP servers before connecting anything.

Sources

• Claude Code docs: Security (opens in a new tab)
• Claude Code docs: Configure permissions (Bash rule limits, Read deny rules, workspace trust) (opens in a new tab)
• Claude Code docs: Configure the sandboxed Bash tool (opens in a new tab)
• Claude Code docs: Choose a permission mode (auto mode block and allow lists) (opens in a new tab)
• Claude Code docs: Development containers (opens in a new tab)
• Claude Code docs: Choose a sandbox environment (opens in a new tab)
• Claude Code docs: Extend Claude with skills (allowed-tools) (opens in a new tab)
• Claude Code docs: How Claude remembers your project (CLAUDE.md loading) (opens in a new tab)
• Anthropic: Agent Skills overview (security considerations, runtime network access) (opens in a new tab)
• Anthropic: Usage Policy, effective 12 November 2026, read 5 November 2026 (opens in a new tab)
• OKX API Agreement, last updated 28 July 2026 (section 8.3) (opens in a new tab)
• OWASP Gen AI Security Project: LLM01:2025 Prompt Injection (opens in a new tab)
• Binance Spot API documentation: Filters (LOT_SIZE) (opens in a new tab)
• Capital Markets Law No. 6362, consolidated text, Article 99/A (Turkish) (opens in a new tab)

This guide is general information about software and markets, not investment, legal or tax advice. Automated trading can lose money, past or backtested performance does not guarantee future results, and the rules that apply depend on your jurisdiction and your exchange's terms. Sources, checks and corrections: see the editorial policy.