MCP in ONIX¶
Model Context Protocol (MCP) is an open protocol for connecting AI applications — coding assistants, chat clients, agent frameworks — to external tools and data through a common, typed interface. An MCP server exposes a set of named tools and their input schemas; an MCP client (the AI application) discovers those tools and calls them on the model's behalf. ONIX uses this same protocol in two places that serve very different purposes and carry very different trust levels — and that must not be conflated with each other.
The two MCP surfaces¶
Backend MCP. The ONIX backend ships its own MCP server as a local, stdio-only process — it is invoked over standard input/output by whatever launches it, not over a network socket, and it is not a network service with its own auth-gated deployment. It exposes a governed surface over the trading engine's own domain: instruments, market data, strategies, backtests, portfolio, risk, and order/execution state. This is documented in full under Backend MCP; this page does not duplicate that material, including its exact tool counts and mutation classification.
The local macOS MCP host. The ONIX macOS client can run a small, separate MCP server on the user's own machine, bound to loopback only, that lets an AI coding client drive the running desktop app — its windows, navigation, and a handful of browser-bridge-backed tools that reach the same frontend a browser tab would load. It is a different process, in a different codebase, with a different trust model than the backend MCP server above. It is documented in The macOS MCP Host.
How they differ in trust and scope¶
| Backend MCP | Local macOS MCP host | |
|---|---|---|
| Where it runs | A local, stdio-only process alongside the backend; not a network service | On the user's own Mac, loopback-only |
| Who can reach it | Whatever process launches it over its own standard input/output | Only local processes on the same machine that hold the connection credential issued from inside the running app |
| What it can see | The engine's own governed domain (instruments, strategies, backtests, portfolio, orders) | Whatever the loaded ONIX frontend page renders, through typed browser bridges the frontend itself installs — plus native shell control (windows, navigation, and an off-by-default diagnostics capability for support use) |
| Mutating capability | Defined by the backend's own MCP contract — see Backend MCP | Order placement and order cancellation are not part of the local host's supported, default-scope tool set. Default-scope mutations that do exist include persisted draft strategy saves, backend backtest submission, screener state changes (apply/reset/sort/select), and connection-console control. Diagnostic scopes intended for support are disabled by default and are outside this support boundary |
| Intended caller | Server-integrated automation, agents operating against the backend's own domain | A developer's own AI coding assistant, running on the same machine as the app, during active development or diagnosis |
The distinction that matters most for a reader: the backend MCP server is a local, stdio-only process wired to whatever process starts it, not a network endpoint with its own authorization scheme — see Backend MCP for exactly how it is invoked and what it can do. The local macOS host is a different kind of surface entirely: it is scoped, by construction, to a single machine, runs only when the user starts it, and — when the app's WebView has an authenticated ONIX session loaded — only reaches what that session's own frontend already renders. It is not reachable from another machine, and order placement and cancellation are not part of its supported, default scope set. See MCP Safety and Scope for the full breakdown of what each surface can and cannot do, and what has (and has not) been reviewed.
Where to go next¶
- The macOS MCP Host — what the local host exposes conceptually, how a client connects, and its security posture.
- MCP Safety and Scope — read-only vs. mutating operations, what is denied by default, and honest review status.
- Backend MCP — the server-side tool families over the trading engine's domain, including its tool counts and mutation classification.
- ONIX macOS Client — the native app that hosts the local MCP server.
Evidence and source pins for this page
Verified. Current behaviour, confirmed in source at the pinned commit.
Verified on against the following immutable sources:
macos@984bdf6c:MCPServer.swift (blob 05f763c1976410fbab50937a3c3c0fdd1583727e)macos@984bdf6c:MCPTools.swift (blob a03bb24902511f8e20430092e2e47acd581d88fd)backend@efa38e04:python/src/onix_engine/mcp/server.py (blob 2220ea55372d076bcb9d752e65be8ce683ba23bf)
Status tokens are defined on the documentation and status model page. Every pin on this site is listed under versions and source pins.