namixai/signer-mcp

> Sign CEX orders from any MCP-aware AI agent — the signing secret never leaves the AWS Nitro Enclave.
signer-mcp is the public face of Usenami Signer. It gives Claude Desktop, Cursor, ElizaOS, and any other MCP-aware client a six-tool surface for trading real CEX/DEX perp accounts (Binance, OKX, Asterdex, KuCoin, Bybit, Hyperliquid) without the signing secret ever entering the agent's process — or yours.
**21 September 2026: we've switched off the hosted Signer this package talks to.** We have no users yet, so we're not paying for idle machines. The package still installs, and list_venues still answers, because that manifest is static. A venue marked live there means the enclave will sign for it once a key is provisioned, not that a service is running. Anything that has to reach the gateway fails: on 1 October 2026 get_attestation came back with Cloudflare's 522. The invite-based pilot described below is on hold while the lanes are off. Everything below about what the enclave does still holds, and the reproducible build and the on-chain registry haven't changed. The notice at the top of namixai/signer says the same from the service's side.
Status: **v0 (alpha), invite-based pilot**. Venue manifest, attestation, account read, place/cancel order, and a two-leg hedge. ⚠️ **Assume orders are real.** Which venue and network your orders hit is decided by the policy bound to your token, and neither this page nor list_venues can tell you which — ask whoever issued the token. There is no implicit testnet safety net, so treat every order as mainnet money until you have confirmed otherwise. Read place_order before sending anything.
---
Why this exists
Every agent framework that touches a CEX today loads the API key into the agent process. That puts the secret on disk, in env vars, in npm packages, in prompt-engineered tool calls, and in your shell history. One prompt injection, one supply-chain compromise, one accidental log line, one curious co-worker — and the key leaks.
Signer takes the opposite approach. The signing key is generated **inside** an AWS Nitro Enclave attested by AWS itself. The enclave's measurement (PCR0) is published on https://usenami.io/signer/attestations. The MCP server you install here can ask the enclave to sign a specific order — bounded by an explicit policy (per-asset cap, per-period cap, allowed venues) — but it cannot read the key. Neither can the agent, your laptop, your IaC, or our own engineers.
If the agent gets compromised, the worst it can do is place orders inside your policy window. The key itself stays attested.
---
Quick start (Claude Desktop)
1. **Get a token.** Access is **invite-based** during the pilot — there is no self-serve signup yet; request access via usenami.io/signer (contact link at the bottom) and your token is provisioned at onboarding, bound to a policy with per-venue caps. **No token yet?** Steps 2–4 still work: list_venues and get_attestation need no token. Note what each one actually does, because only one of them talks to us: get_attestation fetches a live, NSM-signed document **from the gateway**, while list_venues answers from a static manifest compiled into this package and makes **no network call at all**.
2. **Edit claude_desktop_config.json.** Path is ~/Library/Application Support/Claude/claude_desktop_config.json on macOS.
> **Pin @^0.6.0 — earlier versions do not work out of the box.** Every published version up to
> and including 0.5.0 defaults SIGNER_GATEWAY_URL to https://signer.usenami.io, which
> 301-redirects every path to the marketing landing page. The network tools then receive HTML
> and die with Unexpected token ' are pasting a config from an older post or cached answer, check this first — the symptom looks
> like a broken server and is a stale default.
3. **Restart Claude Desktop** and look for the 🔌 plug icon. You should see seven tools listed under signer: list_venues, get_attestation, get_verified_price, get_account, place_order, place_hedge, cancel_order. (The list is named rather than counted on purpose — a count in prose goes stale the moment a tool is added, and this one did: it said six until get_verified_price shipped.)
4. **Try the read-only tools first.** Ask Claude:
> "List the venues available through Signer, then return the current attestation document."
No funds at risk — these don't sign anything, and neither needs a token.
5. **Once you have a token and trust the attestation, you can place a first order — knowingly.**