How to trade news with an LLM agent without giving up custody

You can trade news with an LLM agent by giving it read access to headlines and a scoped API key that places orders in dollar amounts, while your funds remain in a wallet only you control. The agent parses events, maps them to positions, and sends orders through one API, but it cannot withdraw funds, change withdrawal addresses, or spend beyond caps you set. If the model hallucinates a signal or the market moves against the position, hard limits flatten exposure and revoke access before losses exceed your budget.

What does a news-driven LLM agent actually do?

A news-driven LLM agent is an autonomous program that consumes text, reasons about price impact, and requests trades through an API. You connect it to a news feed, social stream, or filings source using an MCP tool or a simple polling script. When a headline arrives, the agent passes it to a large language model along with a prompt that defines its strategy. The model returns a trade intent, such as a direction, a dollar notional amount, and a target market. The agent then calls the Felix API, which translates the plain dollar order into the contract math required by a stock broker, a crypto venue, a perps platform, an options venue, or a prediction market. The agent does not hold your private keys. It holds a scoped key that can only place orders within boundaries you configured. The reasoning layer is entirely separate from the custody layer. This means the LLM can debate whether a central bank announcement is bullish or bearish, but it cannot move your funds to a wallet it controls. The API acts as a gatekeeper that rejects any request that violates budget, position, or market limits. You should start with a single market type. News impacts stocks differently than perpetual futures or prediction markets. A headline about semiconductor export controls might move a chipmaker equity and a related crypto token in opposite directions. An agent that is allowed to trade every market at once may create unintended correlations or hedge itself accidentally. Scope the key to one market until you understand how the agent interprets noise versus signal in that domain. It is important to remember that the LLM is not a crystal ball. It can misread sarcasm, treat an old article as breaking news, or hallucinate a ticker symbol. The value of the agent is speed and consistency, not certainty. Every output should be treated as a proposal that the API validates against your hard limits before it reaches a venue.

How do you keep custody while letting the agent trade?

Non-custodial trading means your funds sit in a wallet that you created and that you control. Felix does not take custody of your capital. When you generate an API key, you are creating a permission slip that lets an agent send orders on your behalf, not a transfer of ownership. The key is scoped, which means it carries a precise list of allowed actions. It can place a buy order for five hundred dollars of a stock. It cannot withdraw five hundred dollars to an external address. Withdrawal addresses are owner-approved and static. You enter them before the agent starts, and the agent cannot add new ones. Even if an attacker compromises the LLM host or the MCP client, they cannot change the withdrawal whitelist. They can only place orders within the daily budget cap. If the cap is one thousand dollars per day, the nineteenth malicious order of the day is simply rejected by the API. This architecture matters because LLM agents are software, and software can be exploited. A prompt injection attack might convince the model to sell everything and buy an irrelevant asset. A scoped key limits the blast radius. The worst-case scenario is not a drained wallet. It is a bounded loss that hits your daily cap, followed by a kill switch that revokes the key and flattens positions. You should also separate the wallet that holds your savings from the wallet that the agent uses. Fund the agent wallet with only the capital you are willing to lose. This is not a feature of the API. It is a personal operational rule. If the agent wallet is compromised, the attacker gains access to your trading budget, not your life savings. For more on how the API handles risk, see how to control risk when LLM agents trade on news through one API.

How do you scope the API key so the agent cannot steal funds?

Scoped keys are the primary defense against both agent error and external attack. When you create the key, you set four guardrails.

• ·Market scope restricts the agent to specific venues. If you only want it to trade stocks and prediction markets, you disable crypto, perps, and options. This prevents the agent from chasing a headline into a market it does not understand.
• ·Budget caps define how much the agent can spend in a given time window. A daily spend cap of two thousand dollars means the agent can place orders until the cumulative notional reaches that limit. After that, the API returns an error for every new order request. This cap is enforced server-side, so the agent cannot override it by asking nicely. It is a hard ceiling.
• ·Position limits control the size of any single trade and the total open exposure. You might set a per-trade limit of five hundred dollars and a total open limit of two thousand dollars. This prevents the agent from concentrating your entire budget in one headline-driven bet. If the agent tries to open a third position when two are already open, the API rejects the order.
• ·Exit plans are automated instructions that run independently of the agent. You can set a stop loss at ten percent below entry and a take profit at fifteen percent above entry. These orders sit at the venue and execute even if the agent is offline or hallucinating. They protect you from gap risk when a headline breaks while you are asleep.

To learn more about sizing, read how position sizing protects owner funds from agent error. For exit automation, see how to automate exit plans and take profits while keeping custody.

How do you write prompts that keep the agent within bounds?

The prompt is a soft guardrail that complements the hard limits encoded in the API key. A well-written prompt does not replace budget caps, but it reduces the number of invalid requests that hit them. Start by defining the universe of tradable events. Tell the agent which sources it may trust, such as official company filings, central bank statements, or verified press releases. Tell it to ignore social media rumors, anonymous tips, and opinion pieces. Require explicit reasoning. Force the agent to write one sentence that connects the headline to the expected price move before it outputs a trade. This creates an audit trail you can review later. If you see the agent writing causal chains that confuse correlation with causation, you know the prompt needs tightening. Set a default action. The safest instruction is, when in doubt, do nothing. An agent that trades on ambiguous news will churn your account and bleed fees. You want an agent that is lazy by design, only acting when the signal is clear. Constrain the output format so the agent cannot improvise. Allow only four fields: market type, ticker, direction, and dollar amount. Any additional text should be treated as reasoning, not instruction. Reference the scoped limits in the prompt. Remind the agent that it cannot exceed five hundred dollars per trade or two thousand dollars per day. This reduces the chance that the LLM hallucinates a large order size. The API will still enforce the limit, but a prompt-aligned agent produces fewer rejected requests and cleaner logs. Finally, include a time constraint. If the agent is meant to scalp news, tell it to ignore headlines older than five minutes. If it is meant to hold positions for days, tell it to avoid intraday noise. A prompt without a time horizon is a recipe for whipsaw losses.

How do you test the strategy before risking real money?

Felix offers paper trading that mirrors the live API. You connect the agent to the paper environment using the same MCP tools or REST calls, but orders are simulated against real market data. The agent does not know the difference. This lets you observe how it behaves when a jobs report drops, when a CEO resigns, or when a geopolitical event spikes volatility. Run the paper agent for enough sessions to cover different market regimes. You need to see how it handles a quiet Tuesday as well as a chaotic Friday. Review the decision logs after each session. Look for three failure modes: false positives, where the agent trades on noise; false negatives, where it misses a clear signal; and reasoning errors, where it draws the wrong causal link. Pay attention to latency. News-driven strategies are time-sensitive. If your LLM provider takes thirty seconds to stream a response, the market may have already moved. Paper trading reveals this delay without costing you money. You may need to simplify the prompt or switch to a faster model to reduce the gap between headline and fill. Only authorize live trading after you are comfortable with the agent's error patterns. You do not need perfection. You need predictability. If the agent makes one large reasoning error per week in paper, that error will cost real money in live trading. Fix the prompt or tighten the scope until the error rate is acceptable. For a checklist on authorization, read what it takes to move an AI trading agent to live trading in 2026.

What should you watch once the agent is live?

Live trading introduces slippage, partial fills, and gap risk that paper trading approximates but never perfectly replicates. Monitor the first few live trades closely. Check that the dollar amount requested matches the dollar amount filled. The API normalizes sizing, but venue liquidity varies. An order for five hundred dollars in a thin prediction market may move the price against you. Watch for prompt drift. Over days or weeks, an LLM can start interpreting broader events as trading signals. A prompt that began with trade only on drug approval headlines may slowly expand to trade on biotech news as the model generalizes. Review the reasoning logs weekly. If the causal chains become looser, rewrite the prompt and restart the agent. Keep the panic switch within reach. The kill switch flattens all positions and revokes the API key instantly. Test it once in paper trading so you know the latency. In a flash crash or a bizarre headline-driven rally, you may need to shut the agent down before the API budget caps are even reached. Manual intervention is still part of the job. Revisit your scope regularly. If the agent hits its daily budget cap every single day, that is not a sign of success. It is a sign of overtrading. Tighten the cap, add a cooldown period between trades, or restrict the hours when the agent is allowed to act. Success in news-driven trading is not about volume. It is about selective, well-sized reactions to genuine surprises. Trading can lose money, including everything. The controls described here limit the speed and magnitude of loss, but they do not guarantee profit. A correct read on the news can still lose money if the market discounts the event faster than your agent can react, or if the price moves for unrelated reasons. The goal of non-custodial agentic trading is not to eliminate risk. It is to keep that risk inside a box that you define.