TreasuryForge Makes Agent Trades Approval-First

The achievement is not autonomous trading; it is making the approval boundary executable. TreasuryForge also shows why agent demos need adversarial review, since early versions contained both an approval bypass and a retry-driven double-execution bug.

• –MCP keeps mutations behind a tool boundary, while server-side checks prevent model-supplied reasoning from becoming risk authority.
• –Runtime approval checkpoints are materially stronger than “ask first” instructions embedded in prompts.
• –Qodo exposed a direct MCP bypass caused by an unauthenticated reset endpoint and overly broad network binding.
• –The project remains demo-grade: local sandboxing is Linux/WSL2-only, backtesting lacks real historical prices, and the frontend has no automated test suite.
• –The pattern generalizes well: deterministic checks and human authorization belong at the mutation boundary, not inside the model’s context.