Agent Harness

A capability-gated workflow and executable action graph for agents that discover, read, stream low-latency order commands, externally sign, and safely submit Strata operations.

This is the canonical first-run workflow for any agent entering Strata. Live capabilities remain the authority: this harness explains how to work, but never grants permission.

Read-only starts immediately

Market discovery, books, marks, candles, trades, quotes, public portfolios, Points, maker status, and reputation require no wallet, approval, session key, or environment setup. Call those tools directly. Never interrupt a read-only request with trading-session onboarding.

A session key is needed only after the user asks the agent to sign a trading write. Never request or accept that secret in chat; direct the user to run npx -y @stratabook/mcp connect, which generates it locally and opens the Agents page with only the public key. The user chooses on-chain limits and signs once; rerunning the command atomically replaces the old session. Revoke, withdraw, pause, and policy changes always stay in the connected owner wallet.

Automatic entry

MCP: connect to the hosted Strata MCP server. Initialization points agents to the versioned harness resource and prompt.
Terminal: use the official TypeScript terminal client when MCP is unavailable.
Manifest: discover the machine-readable harness at the Strata agent manifest.
Action graphs: fetch the compact executable graph and the complete platform graph to discover entity relationships, available operations, and workflow transitions.

Authority model

The external agent owner decides what the agent may do and configures its signer. Strata does not receive private keys or impose an additional human-approval policy. It exposes reviewed operations, verifies signatures and immutable quote bindings, and returns durable receipts.

The graph entry node is discover_capabilities. Follow live edges only when their conditions and required capabilities are satisfied.

Context router

Start from the small strata://agent-router/v1 resource, select exactly one leaf, then load only that leaf. Use the matching profile=LEAF MCP connection profile to make the boundary executable: unrelated tool schemas are omitted and out-of-profile calls are rejected. Advanced protocol control is an interface mode layered over the selected domain, not a separate knowledge branch.

read / platform — Capability, service-status, and action-graph discovery. Load only strata://agent-branch/platform/v1.
read / market_data — Markets, books, trades, candles, marks, and read-only quotes. Load only strata://agent-branch/market_data/v1.
read / account — Public portfolio, balances, orders, fills, and stored equity history. Load only strata://agent-branch/account/v1.
participation / points — Fleet-wide Points, immutable balances, rank, standings, and legacy rewards. Load only strata://agent-branch/points/v1.
participation / referrals — Referral status, link authorization, and owner-authorized claims. Load only strata://agent-branch/referrals/v1.
participation / bugs — Public bug status and owner-authorized bug reports. Load only strata://agent-branch/bugs/v1.
execute / immediate_trade — Quote-bound immediate buys and sells with durable execution status. Load only strata://agent-branch/immediate_trade/v1.
execute / limit_orders — Resting order placement, cancellation, replacement, batching, and dead-man protection. Load only strata://agent-branch/limit_orders/v1.
execute / twap — TWAP scheduling, cancellation, recovery, and sequenced progress. Load only strata://agent-branch/twap/v1.
execute / market_making — Maker state, reputation, Strand, Current, and intent execution. Load only strata://agent-branch/market_making/v1.
custody / vault — Vault status, session onboarding, funding, and autonomy inspection. Load only strata://agent-branch/vault/v1.
admin / vault_admin — Owner-authorized withdrawal, pause, revocation, and withdrawal-policy controls. Load only strata://agent-branch/vault_admin/v1.

Required workflow

discover capabilities — Call the requested read-only tool directly. Read the live capability catalog only when a requested tool is unavailable, the objective is advanced or ambiguous, or the user explicitly asks what Strata supports. Never turn capability discovery into a prerequisite for a normal market, book, account, or quote request.
establish mode — Use the compact default MCP tools for ordinary requests. Read the action graphs and use the advanced tool surface only for an integration that needs explicit challenge, prepare, sign, and submit control. The external agent owner configures permissions and signer authority.
understand objective — Resolve the user's market or input/output assets, side when applicable, amount, and tolerance. Ask before proceeding when any economically meaningful input is ambiguous.
discover market — Pass familiar labels such as SOL/USDC to simple tools. Call strata_markets only when the market is unknown or a low-level operation needs opaque IDs and decimals. Do not guess identifiers or token decimals.
read market data — When books.read is live, use the opaque market ID to read the Strata book, status, fees, and recent trades. Subscribe to the market stream for changes and recover from any sequence gap with a fresh snapshot.
read account — Read the whole account with one public call by wallet address (portfolio.read / strata_portfolio / account.read(wallet)): balances, positions, open orders, and recent fills across every live market — no signature, no session key, no market selection. Per-market signed account reads and streams (account.read / account.stream) exist only for owners who want a signed, per-market view; never make them a prerequisite for trading.
read portfolio — Before sizing any action, read the account once (portfolio.read): exact per-asset total, available, and locked atoms, per-market positions, open orders, recent fills, and USD totals with the observed slot. Treat null USD totals as an incomplete valuation, never as zero; markets listed in unavailable_market_ids did not report orders and fills for that snapshot; use the typed stored-history operation for past equity.
read vault — Before session-owned execution, read the official Vault status for the owner and external session key. Continue only when the product is active, the session is active, and market_execution_ready is true; treat opaque asset limits and withdrawal access as authoritative.
protect vault — When an owner requests a Vault pause or resume and vault.pause is live, prepare the exact transaction with the official SDK, verify that the wallet and requested state are unchanged, then have the owner-configured signer sign and broadcast it externally. Preparation alone does not change state.
onboard vault — Onboarding is one owner signature: register the external session key with vault.setup (only the wallet and the session key are required; one session then trades every market) or simply name the session key on the first vault.deposit, which registers it in the same transaction. Policy fields — expiry, cadence, tolerance, per-asset limits — are optional. Supplying replace_session_public_key atomically revokes the old key while registering the new one. Verify every echoed field and the prepared transaction before external owner signing and broadcast; retain the session key only in the owner's signer.
fund vault — When vault.deposit is live, select an asset from the discovered market and use an exact positive atomic amount. Verify the echoed owner, market, asset, and amount plus the prepared transaction before external owner signing and broadcast.
withdraw vault — When vault.withdraw is live, choose an exact market asset, destination-owner wallet, and positive atomic amount. Verify every echoed binding and the prepared transaction before external owner signing and broadcast; the on-chain withdrawal policy remains authoritative.
revoke vault session — When an owner requests session revocation and vault.delegate.manage is live, bind the exact owner wallet and external session public key. Verify both identities and the destructive revoke action before external owner signing and broadcast; preparation alone does not revoke access.
control vault withdrawals — When vault.policy.manage is live, use blocked mode with no allowed wallets to freeze withdrawals or restricted mode with one to eight exact destination-owner wallets. Verify the echoed mode and complete wallet list before external owner signing and broadcast.
reconcile maker status — When mm.status.read is live, read the maker's products by wallet address (public, no signature) before and after any maker action: resting firm orders, live signed quotes, each Strand and Current with its remaining exposure and expiry, oracle health, and armed dead-man guards. Reconcile against what the agent believes it posted; treat missing, expired, or disabled products as not quoting.
stream maker fills — When mm.fills.stream is live, keep one maker stream open per market through the official SDK by wallet address (public, no signature): start from the maker snapshot, apply only contiguous maker_fill and maker_status events, and recover any gap or reconnect from a fresh snapshot. Reconcile every fill and exposure change against the maker's own state before quoting further.
inspect maker reputation — When mm.reputation.read is live, read the maker's record by wallet address (public, no signature). Use the tier, reliability counters, tier-progress gates, signed-quote eligibility, and minimum cadence before choosing the maker transport; do not infer hidden counterparties or execution paths.
preserve atoms — For simple MCP tools, prefer exact human strings such as 0.1 SOL, 20 USDC, or $20; the MCP resolves decimals without floating point. For SDK and advanced tools, represent settlement amounts as unsigned base-10 atomic strings and never use floating-point arithmetic.
read points — Use points.read / strata_points for the complete fleet-wide Points source of truth in one request: current Season and epoch, weekly budget, named lane weights, immutable owner balance and breakdown, rank, standings, and allocation finalization time. Eligible trading, making, confirmed bugs, and referrals accrue automatically across every live market. Never present provisional current-week activity as an earned balance; balances and ranks contain closed immutable epochs only.
authorize community actions — For referral link or claim actions, generate the exact official SDK authorization payload, have the affected owner wallet sign it externally, and submit only the detached signature with the same referral code or payout wallet binding.
request quote — Call strata_quote directly with a market label, side, and exact human amount. Use opaque asset IDs or exact atoms only for the advanced swap and protocol interfaces. The tolerance is the user's economic choice; zero is the safe default.
validate quote — Verify the quote binds to the selected market and side or the selected input/output assets, plus the exact input and tolerance. Check labelled fees, minimum output, price impact, server time, and expiry.
report result — Report consumed input, expected output, minimum output, fees by asset side, price impact, and remaining validity.
authorize writes — When prepare and submit are exposed, keep signing external to Strata and use one signature per action: send the operation itself to prepare (orders, TWAP, quote-bound execution), verify the returned transaction, sign only that transaction with the session key, then submit with idempotency. The SDK's built-in verifier decodes the transaction and requires it to be exactly the requested operation for that market with the session co-signing only delegated instructions and never paying; a stricter owner verifier may replace it. The two-step challenge path (authorization bytes signed first) remains available. Resting-order control supports place, cancel, bounded cancel-all, atomic replace, and atomic heterogeneous batches of up to six operations. Proactive self-trade cancellation is optional and must be activated only when the owner explicitly requests a policy. Omitted policy means normal placement; Strata still prevents actual self-fills.
stream order commands — When orders.prepare and orders.submit advertise websocket transport, use the official SDK persistent order-command connection. Sign its owner/session/market challenge externally, require contiguous sequences and correlated request IDs, treat the submit result as RPC broadcast only, and consume the pushed terminal status without blocking the placement hot path.
maintain dead man — Before leaving resting exposure unattended, arm an exact externally verified and pre-signed cancel-all ticket, then maintain its SDK heartbeat. Dropping the guard or losing the agent must stop heartbeats and fail closed into cancellation; disarm only through an explicit owner-authorized action.
certify order command slo — Use the official non-trading order-command certification harness before release and on the production schedule. Retain its machine-readable connection count, load, latency percentiles, sequence/error rate, thresholds, and pass/fail result; package support alone is not a latency claim.
stream execution state — When execution.stream is live, watch every execution handle you prepared through the official SDK's sequenced execution stream instead of polling status: start from its snapshot, apply only contiguous execution_update, execution_expired, and execution_unknown events, recover any gap from a fresh snapshot, and treat an expired or unknown handle as not executed unless a confirmed receipt says otherwise.
stream twap progress — When algos.twap.stream is live, keep the official SDK's TWAP stream open for the owner wallet across the markets with active schedules: start from the snapshot, apply only contiguous twap_update events, and recover any gap from a fresh snapshot. Report executed size, achieved value, fees, and the terminal receipt from the streamed rows rather than polling.
monitor outcome — After an authorized submission, report the RPC-broadcast receipt and then the durable terminal status or explicit failure. If the request times out or either process restarts, recover it with the same control ID and idempotency key. Never claim chain completion from preparation, signing, or the immediate broadcast receipt.

Advanced MCP inventory

strata_capabilities, strata_action_graph, strata_platform_graph, strata_status, strata_markets, strata_book, strata_bbo, strata_trades, strata_marks, strata_candles, strata_quote, strata_exact_output_quote, strata_swap_quote, strata_portfolio, strata_portfolio_history, strata_points, strata_rewards, strata_referrals, strata_referral_link, strata_referral_claim, strata_bugs, strata_bug_submit, strata_trade, strata_execute_quote, strata_execution_challenge, strata_execution_prepare, strata_execution_submit, strata_execution_status, strata_order_challenge, strata_order_prepare, strata_order_submit, strata_order_status, strata_order_execute, strata_twaps, strata_twap_challenge, strata_twap_cancel, strata_twap_prepare, strata_twap_submit, strata_twap_execute, strata_market_making_status, strata_market_making_reputation, strata_market_making_prepare, strata_market_making_submit_and_wait, strata_market_making_intent_execute, strata_market_making_strand_prepare, strata_market_making_strand_submit, strata_market_making_current_prepare, strata_market_making_current_submit, strata_market_making_intent_prepare, strata_market_making_intent_submit, strata_autonomy, strata_vault_status, strata_vault_setup, strata_vault_deposit, strata_vault_submit, strata_vault_submission, strata_vault_withdraw, strata_vault_delegate, strata_vault_policy, strata_vault_pause

Terminal sequence

npx -y @stratabook/sdk capabilities --json
npx -y @stratabook/sdk action-graph --json
npx -y @stratabook/sdk platform-graph --json
npx -y @stratabook/sdk platform-status --json
npx -y @stratabook/sdk mark --market-id MARKET_ID --json
npx -y @stratabook/sdk candles --market-id MARKET_ID --from-ms FROM_MS --to-ms TO_MS --resolution-seconds 300 --json
npx -y @stratabook/sdk execution-status --market-id MARKET_ID --execution-id EXECUTION_ID --json
npx -y @stratabook/sdk twaps --market-id MARKET_ID --wallet WALLET_PUBLIC_KEY --json
npx -y @stratabook/sdk twap-challenge --market-id MARKET_ID --owner-wallet OWNER_PUBLIC_KEY --session-public-key SESSION_PUBLIC_KEY --side buy --total-size-atoms TOTAL_ATOMS --slices 10 --tolerance-bps 100 --interval-slots 100 --limit-price-atoms PRICE_ATOMS --json
npx -y @stratabook/sdk twap-cancel --market-id MARKET_ID --owner-wallet OWNER_PUBLIC_KEY --session-public-key SESSION_PUBLIC_KEY --twap-id TWAP_ID --json
npx -y @stratabook/sdk twap-prepare --market-id MARKET_ID --owner-wallet OWNER_PUBLIC_KEY --session-public-key SESSION_PUBLIC_KEY --side buy --total-size-atoms TOTAL_ATOMS --slices 10 --tolerance-bps 100 --interval-slots 100 --limit-price-atoms PRICE_ATOMS --json
npx -y @stratabook/sdk twap-submit --market-id MARKET_ID --twap-control-id CONTROL_ID --signed-transaction-base64 TRANSACTION --idempotency-key KEY --json
npx -y @stratabook/sdk account --wallet WALLET_PUBLIC_KEY --json
npx -y @stratabook/sdk portfolio-history --wallet WALLET_PUBLIC_KEY --range 24h --json
npx -y @stratabook/sdk maker-status --market-id MARKET_ID --wallet WALLET_PUBLIC_KEY --json
npx -y @stratabook/sdk maker-reputation --market-id MARKET_ID --wallet WALLET_PUBLIC_KEY --json
npx -y @stratabook/sdk vault-status --wallet WALLET_PUBLIC_KEY --session-public-key SESSION_PUBLIC_KEY --json
npx -y @stratabook/sdk session-keygen --json
npx -y @stratabook/sdk vault-setup --wallet WALLET_PUBLIC_KEY --session-public-key SESSION_PUBLIC_KEY --json
npx -y @stratabook/sdk vault-deposit --wallet WALLET_PUBLIC_KEY --market-id MARKET_ID --asset-id ASSET_ID --amount-atoms AMOUNT --session-public-key SESSION_PUBLIC_KEY --json
npx -y @stratabook/sdk vault-withdraw --wallet WALLET_PUBLIC_KEY --market-id MARKET_ID --asset-id ASSET_ID --destination-wallet DESTINATION_WALLET --amount-atoms AMOUNT --json
npx -y @stratabook/sdk vault-delegate --wallet WALLET_PUBLIC_KEY --session-public-key SESSION_PUBLIC_KEY --action revoke --json
npx -y @stratabook/sdk vault-policy --wallet WALLET_PUBLIC_KEY --mode restricted --allowed-wallets DESTINATION_WALLET --json
npx -y @stratabook/sdk vault-pause --wallet WALLET_PUBLIC_KEY --paused true --json
npx -y @stratabook/sdk points --wallet WALLET_PUBLIC_KEY --json
npx -y @stratabook/sdk rewards --wallet WALLET_PUBLIC_KEY --json
npx -y @stratabook/sdk referrals --wallet WALLET_PUBLIC_KEY --json
npx -y @stratabook/sdk referral-link --wallet WALLET_PUBLIC_KEY --code REFERRAL_CODE --json
npx -y @stratabook/sdk referral-claim --wallet WALLET_PUBLIC_KEY --json
npx -y @stratabook/sdk bugs --wallet WALLET_PUBLIC_KEY --json
npx -y @stratabook/sdk bug-payload --message REPORT_TEXT --json
npx -y @stratabook/sdk markets --json
npx -y @stratabook/sdk quote --market SOL/USDC --side sell --amount-atoms 10000000 --json
npx -y @stratabook/sdk swap-quote --input-asset-id INPUT_ASSET_ID --output-asset-id OUTPUT_ASSET_ID --amount-atoms 10000000 --json
npx -y @stratabook/sdk order-slo --market-id MARKET_ID --owner-wallet OWNER_PUBLIC_KEY --json

Stop conditions

The required live capability is disabled or absent.
The market is paused, unavailable, or has no reviewed operation path.
Market, side, amount, decimals, tolerance, or signer authority is unavailable or ambiguous.
The contract version is unsupported or a response contains unknown fields.
A quote is expired or its market, side, amount, fee, minimum-output, or time binding is inconsistent.
A requested operation exceeds the exposed tool, account, or policy scope.
A user asks the agent to receive or expose wallet secrets, private keys, seed phrases, session keys, or production credentials.

Safety rules

Never request or accept wallet secrets, private keys, seed phrases, session keys, or production credentials in a prompt.
Never call undocumented endpoints or reconstruct private Sonar behavior.
Never silently widen the tolerance, refresh changed economics, substitute a market, or retry a non-retryable failure.
Never activate a self-trade cancellation policy without an explicit owner request, suppress an order-command sequence gap, or disarm a dead-man ticket merely because the client is shutting down.
Treat capability removal, revocation, expiry, and emergency disable as immediate stop signals.
Capability and action-graph availability are authoritative for Strata operations; permission and signer policy remain controlled by the external agent owner.

Call ordinary read-only tools directly. Capability and action-graph discovery is for unavailable, ambiguous, or advanced operations; it is not a prerequisite for a quote.