A Bank Published the Commands That Let AI Trade for You

Scalable Capital said on Tuesday it had become the first bank in Europe to connect client accounts to general-purpose AI assistants. Clients can switch on Agentic Investing in their profile and point ChatGPT, Claude or Grok at their brokerage account.

The interesting part is not the announcement. It is that the bank published the command list, so it is possible to read exactly what an assistant is being handed.

Thirty-nine commands

Scalable's client is a command-line tool called sc, written in Rust and released on GitHub under Apache-2.0. Its README documents 39 distinct invocations.

Most are reads: portfolio overview, holdings, analytics, transactions, quotes, charts, securities search, derivatives search, security news, and the balance and transaction history of the overnight savings account. A further group edits things that do not move money — watchlists, price alerts, and portfolio groupings the agent can create, rename, populate and delete.

Three commands place or cancel an order: trade buy, trade sell and trade cancel. A fourth, savings-plans add, commits to a recurring one. Order types are market, limit and stop.

The bank wrote its regulatory duties into the agent's instructions

Buys, sells and savings-plan changes are deliberately two-step. The first call previews the order and returns a short-lived confirmation ID. Placing it requires repeating the identical arguments with that ID attached.

For savings plans the README goes further, and the wording is worth reading as written. Phase one returns the full ex-ante cost disclosure. The agent is then told to "present every value in that disclosure to the client, obtain an explicit affirmative response in a separate interaction, then repeat the exact arguments".

That is a MiFID-style obligation expressed as an instruction to a language model. So is the flag --accept-unsuitable, which exists for buy orders the first phase flags as unsuitable and which the user has to pass deliberately.

There is also a failure rule. If the second phase returns an unknown outcome, the README says plainly: "do not retry it." Instead the agent is to list the savings plans for that account and inspect the result, which is the only thing that clears a local safety gate before a new preview. Anyone who has watched an automated client retry a timed-out request will recognise what that is guarding against.

The guardrails you set run on your own machine

The CLI lets a user define local trade controls in a config file: a list of permitted ISINs, a list of denied ones, and a maximum order size.

The README is explicit about their reach. These controls "are enforced locally by the CLI only" and "do not change your account permissions or backend trading permissions". They are a seatbelt in the client, not a limit on the account. An agent driving a different binary, or the hosted interface rather than the CLI, is not bound by them.

The same document warns about provenance, telling users that only binaries from Scalable's own GitHub releases and Homebrew tap are distributed by the bank, and that anything built from a fork, a third-party package manager or a container image is not. The authentication signing key defaults to the Secure Enclave on macOS.

What is published, and what is not

The CLI is fully public. The MCP server is not, in the same sense.

Model Context Protocol appears 61 times on Scalable's Agentic Investing page and not once in the CLI's README. There is no repository, package or published tool list for it. The company's own suggested way to find out what it exposes is a prompt it prints among its examples: "Show me your capabilities through the Scalable MCP."

That is a reasonable design — a hosted MCP endpoint is not a thing you install — but it means the two halves of this launch have different levels of public scrutiny. The interface a developer runs locally can be audited line by line before an account is connected. The interface an ordinary client will actually use through ChatGPT cannot.

Someone else built this first

The CLI repository was created on 24 March 2026, five months before the announcement. It was public in the meantime, and independent developers noticed.

GitHub carries three unofficial MCP servers for Scalable Capital. The earliest was created on 7 June 2026 and describes itself as a read-only server for viewing a portfolio in Claude. The second, on 17 June, is explicitly a read-only wrapper around the sc CLI. A third arrived on 18 August, a week before the launch, covering overview, holdings, transactions and analytics. All three say they are unofficial; two say they are read-only.

None of them has meaningful adoption — between them they hold a single star. The point is not their popularity but their existence and their dates: the agent interface to this bank was being built by its users out of its own published client, months before the bank shipped one.

What the bank says it is not responsible for

The product page carries a disclosure worth quoting in full alongside the launch language. Scalable's MCP and CLI, it says, "are purely interfaces to external AI applications. These third-party tools operate independently and outside Scalable's control. Usage and data transmission are at your own risk. AI-generated outputs or transactions originate solely from the third party and do not constitute investment advice or recommendations by Scalable Capital. Scalable Capital does not warrant output accuracy."

Erik Podzuweit, founder and co-chief executive, framed it more expansively: "Agentic Investing represents the greatest technological shift in financial technology since internet banking. By opening our platform, we are setting the benchmark for how humans, AI, and the capital markets interact."

Both things are on the same website. The bank has engineered the confirmation flow, the disclosure requirement and the retry rule into the interface, and disclaimed the behaviour of whatever is on the other end of it.

What is established and what is not

Established: Scalable Capital announced Agentic Investing on 25 August 2026 from Munich, naming ChatGPT, Claude and Grok, activated under Profile and Security, offering both a CLI and an MCP server. The CLI repository was created 24 March 2026, is Apache-2.0, written in Rust, and had 384 stars, 12 forks and 11 open issues when we read it on 26 August. Its README documents 39 commands, of which three place or cancel an order. Trades and savings-plan additions require a two-step confirmation, savings-plan previews return an ex-ante cost disclosure, and the README instructs the agent to obtain consent in a separate interaction and not to retry an unknown second phase. Local trade controls are enforced by the CLI only. Three unofficial MCP servers exist, created 7 June, 17 June and 18 August 2026.

Not established: what the official MCP server exposes, which is not documented publicly; whether its tool surface matches the CLI's 39 commands; how many clients have activated the feature, which is not disclosed; and whether the claim to be the first bank in Europe to do this holds, which is a negative we have not attempted to prove. We did not connect to the MCP server or to any account, and all figures here come from public pages and repository metadata.

The narrow reading is that a European broker has handed general-purpose AI assistants the ability to trade a client's account, has written the investor-protection steps into the instructions the model reads, and has published enough of the client for anyone to check the first half of that sentence but not the second.