When a natural-language prompt can open a leveraged perpetual and bridge the profit to another chain without me writing a single REST call, the boundary between "chatbot" and "trading backend" has quietly moved. That is exactly what happened when the iAgent SDK was announced on July 14, 2026, arriving days after an open-source MCP server (early July, ~5 July) exposed 22 tools that turn a language model into a full-execution on-chain trader. I have spent the last few weeks wiring both into a development harness, and this is the practical, developer-facing walkthrough I wish I had on day one.
What the iAgent SDK Actually Is
The iAgent SDK is a toolkit for building an on-chain AI trading agent that lives on an L1 order book rather than an off-chain API. Where most "AI trading" products are a thin wrapper that eventually POSTs to a centralized exchange, this stack signs and submits real transactions to the chain's exchange module. That distinction matters to me as a developer: the order book, the derivatives markets, and contract deployment are all first-class primitives the agent can reach, not features behind a broker.
Practically, the SDK gives me a programmatic agent I can create, configure with a wallet, and hand a strategy or a live prompt. The July 14 announcement framed it as letting users spin up their own on-chain agent, and the companion MCP server is what makes that agent controllable from any Model Context Protocol client. In my testing the two are complementary: the SDK is the agent runtime, the MCP server is the tool surface that a language model calls into.
Installing the iAgent SDK
I keep the environment boring and reproducible. A clean virtualenv, pinned dependencies, and secrets in a local .env that never gets committed.
git clone https://github.com/InjectiveLabs/injective-agent-sdk.git
cd injective-agent-sdk
python -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
Then the two things every on-chain agent needs — a signing key and a network target:
## .env (never commit this)
INJECTIVE_PRIVATE_KEY=0x... # a burner key on testnet first
NETWORK=testnet # testnet | mainnet
LLM_API_KEY=... # your model provider key
My hard rule: I run everything on testnet with a burner wallet until I have watched the agent open and close at least ten positions correctly. Signing keys are the whole game here — the agent has real spend authority, so I treat a leaked key the same as a drained account. I also fund the subaccount with a small, known amount so a logic bug caps its own blast radius.
Connecting the MCP Server
The MCP server is the piece that lets a model "see" the tools. It speaks the Model Context Protocol, so it drops into MCP-aware clients out of the box — the maintainers list Claude Desktop, Cursor, LangChain, and CrewAI as supported. For a desktop client, the config is a single server entry:
{
"mcpServers": {
"injective": {
"command": "python",
"args": ["-m", "injective_mcp.server"],
"env": {
"INJECTIVE_PRIVATE_KEY": "0x...",
"NETWORK": "testnet"
}
}
}
}
The security design is the part I actually respect. The private key is stored locally with AES-256-GCM encryption and scrypt key derivation, and it is never exposed to the model. The language model only ever sees wallet addresses and transaction hashes; signing happens locally with the user's key, with no custodian in the loop. That means I can point a hosted model at the server without shipping my key to anyone — the model orchestrates, my machine signs.
The 22 Tools, Grouped
The server ships with 22 tools, and mentally grouping them made the whole thing click for me. Four buckets cover the workflow end to end:
- Market data — query active spot and derivative markets, funding rates, order book depth, recent trades.
- Trading — deposit into a subaccount, place market and limit orders, open leveraged positions, monitor P&L, close trades.
- Transfers — move tokens between wallet and subaccount, send to other addresses.
- Bridging — move assets cross-chain, e.g. bridging realized profit off the L1.
Because these are exposed as discrete MCP tools, the model composes them itself. I do not script the sequence "check funding → deposit → open → monitor → close"; I describe the goal and the agent chains the calls. My job shifts from writing the pipeline to constraining it.
Trading Command Examples
This is where a developer feels the difference. Each of these prompts, in an MCP client wired to the server, resolves to a real signed transaction — natural language in, order book state out.
"Show me the active perp markets and their current funding rates."
"Deposit 50 USDT into my derivatives subaccount."
"Open a 3x long on INJ/USDT perp with 25 USDT margin."
"What's my current unrealized P&L across open positions?"
"Close half of my INJ perp position at market."
"Bridge my realized profit to Ethereum."
I always run each command first with an explicit "dry run — describe the transaction you would sign but do not submit" preamble. The agent then narrates the tool calls and parameters, I sanity-check the market, size, and leverage, and only then do I let it execute. That one habit has caught more than one oversized-position bug in my own strategy prompts.
Derivatives: Perps and Funding
The headline capability is derivatives. This was billed as the first blockchain to let AI agents trade perpetual futures through natural language, and the full lifecycle is reachable: query funding, deposit margin, open a leveraged position, track unrealized P&L, and close — all on-chain. For an algo developer that unlocks strategies I could previously only run against a CEX API: funding-rate arbitrage, delta-neutral basis trades, or a simple momentum agent that flips a perp on a signal.
A concrete pattern I have been testing: the agent polls funding rates on a schedule, and when a market's funding crosses a threshold I set, it opens a position sized against the subaccount balance and writes the transaction hash to a log. Because the model only ever sees addresses and hashes, my post-trade reconciliation reads straight from chain state rather than trusting the model's own summary — I never let the LLM be the source of truth for what actually happened.
What a Full-Execution Backend Really Means
"Full-execution backend" is not marketing filler here; it is a specific claim I can verify by watching transactions land. The server does not hand the model a read-only view and ask a human to click confirm. It signs and submits. That is powerful and dangerous in equal measure, so my production checklist is short and non-negotiable: testnet until proven, burner key with capped balance, per-command dry runs during development, hard position-size and leverage limits enforced in the agent config (not just the prompt), and chain-state reconciliation after every session. Contract deployment through the same natural-language surface is genuinely useful for prototyping, but I keep that behind an extra manual gate — deploying code from a prompt deserves human eyes.
Frequently Asked Questions
Do I have to hand my private key to the AI model?
No. The key is encrypted locally (AES-256-GCM with scrypt) and never leaves your machine. The model sees only wallet addresses and transaction hashes; signing is done locally with your key, with no custodian involved.
Which clients does the MCP server work with?
It is compatible out of the box with Claude Desktop, Cursor, LangChain, and CrewAI — any Model Context Protocol-aware client can consume its tools.
How many tools are there and what do they cover?
Twenty-two tools, spanning market data, trading (including leveraged perps), token transfers, and cross-chain bridging. The model composes them; you constrain them.
Is this safe to run on mainnet immediately?
I would not. Start on testnet with a burner key and a small, capped subaccount balance. Only move to mainnet once you have watched the agent open, monitor, and close positions correctly across many runs.
Conclusion
The July 14, 2026 iAgent SDK announcement, paired with the open-source MCP server and its 22 tools, is the first time I have been able to treat a language model as an actual on-chain trading backend rather than a suggestion box. The local-key security model makes it usable without surrendering custody, and the derivatives support opens real algorithmic strategies to natural-language orchestration. My honest advice as a developer: the ergonomics are excellent, but the responsibility is entirely yours. Wire it up on testnet, group the tools in your head, dry-run every command, cap the risk in config, and reconcile against chain state — then this stack earns its place in a serious trading harness.
