Mishmar
Risk limits and approvals for trading bots and AI agents
FreeOpen SourceCryptoSecurity9 impressionslaunches Nov 171 comment
Comments
>log in to comment
Hi, I'm Ishai, and I build Mishmar. Your bot or AI agent proposes each order, Mishmar checks it against your limits, and it is co-signed, held for your approval, or blocked. The exchange key is split between the signer next to your bot and Mishmar, so neither can trade alone. Live with real money on Hyperliquid and Binance since 9 November, free to start. If you run a bot: where do its limits live today?
Mishmar is a risk management layer for trading bots and AI agents: every order is checked against your limits before it reaches the exchange, large orders wait for your approval, and no key can trade alone.
- Rules for order size, exposure, leverage, concentration, drawdown and daily loss, per agent, per portfolio or across the account. Each rule blocks, asks you, or only logs.
- The exchange key is split between the signer next to your bot and Mishmar. An order needs both halves, so a leaked bot key signs nothing.
- Python and TypeScript SDKs (
pip install mishmar,npm install mishmar), a CLI, and an MCP server (npx -y mishmar mcp), so Claude, Cursor or any MCP client can trade through your limits without seeing a key. - Every decision is signed into a chained log you can verify offline, and PnL is tracked per agent from the fills.
- Live with real money on Hyperliquid and Binance. The Free plan needs no card: one agent and one trading account. Hyperliquid testnet and Binance demo trading are there to try it first. The signer and SDKs are open source (Apache-2.0).
Start free: app.mishmar.io. Or try the console on sample data, no sign-up: demo.mishmar.io
More Open Source tools →74 free dev tools →
Looking for MCP servers to install? MCP servers list: 289 servers by category, official and community →
Mishmar adds a risk-management layer that checks and co-signs every trading bot or AI agent order against configurable limits before it reaches an exchange.
- for
- Developers building trading bots or AI agents that need order-level risk controls.
- pricing
- free
- license
- Apache-2.0
Key features
- Multi-sig order signing — Each order requires half the exchange key from the bot and half from Mishmar, preventing solo key misuse.
- Configurable risk limits — Set rules for order size, leverage, exposure, drawdown, and daily loss per agent or portfolio.
- Approval workflow for large orders — Orders exceeding limits are parked for manual approval via the console.
- Chained audit log — Every decision is signed into an immutable log that can be verified offline.
- Python and TypeScript SDKs — Install via pip or npm to integrate Mishmar checks into existing bot code.
- CLI and MCP server — Command-line tool and MCP server let any MCP client trade through Mishmar without exposing keys.
Use cases
- Block runaway bots by enforcing per-trade size and leverage caps
- Require manual approval for high-value trades before they hit the exchange
- Maintain separate key halves so a leaked bot key cannot execute trades alone
- Audit all order decisions with a signed, searchable ledger
Mishmar vs alternatives
 Mishmar |  Mastra |  LangGraph |  Devin |  LangChain | |
|---|---|---|---|---|---|
| Best for | Order limits and multi-sig approvals for bots | TypeScript AI agent development | Stateful AI agent orchestration | Autonomous AI coding | LLM application development |
| Pricing | Free | Free | Free | Subscription | Free |
| DevHunt upvotes | 1 | 0 | 0 | 0 | 0 |
| Launched | Nov 2026 | — | — | — | — |
- Mishmar vs Mastra: Mastra is a TypeScript framework for building AI agents, not a risk-management layer for trading bots.
- Mishmar vs LangGraph: LangGraph provides stateful agent workflows but does not enforce order-level risk limits or multi-sig signing.
- Mishmar vs Devin: Devin focuses on autonomous AI software engineering, not on trading order risk controls.
- Mishmar vs LangChain: LangChain is a general LLM app framework without built-in trading risk management or key splitting.
Mishmar FAQ
How does Mishmar protect against a compromised bot key?+
The exchange key is split; the bot holds only half, which cannot sign orders without Mishmar’s co-signature.
Can I set different limits for each trading agent?+
Yes, limits can be defined per agent, per portfolio, or across the entire account.
What happens when an order exceeds a defined limit?+
Each rule says what happens: the order is blocked, held until you approve or reject it in the console, or let through and logged.
Is there a free way to try Mishmar?+
Yes. The Free plan runs with real money on Hyperliquid or Binance, needs no card, and holds one agent and one trading account. Hyperliquid testnet and Binance demo trading are free too, if you want to try it with test funds first.
Do I need to expose my exchange API keys to Mishmar?+
No, only half of the key is stored with Mishmar; the bot holds the other half, and both halves are required to sign an order.
Edited by the makers, based on mishmar.io · Nov 8, 2026. Details may change; check the official site.
