The fastest way to lose money with a trading agent is to point it at a real account before you know how it behaves. So the first question for any agent that can place an order is not “how do I connect it” but “what is it allowed to do right now”. PitBridge answers that with a permission mode set per account: read-only, paper or live. The mode is checked on every order, before a guardrail even runs, and a fresh install starts in the safe one.
Three modes, one gate
Each account runs in exactly one mode. The permission check sits early in the order pipeline, right after schema validation and before the guardrail engine, so the mode decides whether an order is even eligible to be checked.
- read-only: the account never mutates a broker. Every read tool works, but any order-placing tool is refused, and so is close or flatten, because closing a position changes a real one. This is the mode for an agent that should watch and explain but touch nothing.
- paper: orders are placed freely against a NinjaTrader simulation account such as Sim101. The agent can trade a whole session, hit guardrails, trip the kill switch and read the audit log, all with no real money at risk. This is where a new agent lives.
- live: orders can reach a real account, but only after an operator has armed live at the command line. Until then, a live-configured account behaves as if it cannot trade.
Why a fresh install is paper only
Install PitBridge and run it with no config at all, and it boots a zero-config demo sandbox: a fake account, every guardrail on, live locked, and no broker link. It cannot place a real order because there is nothing real to place one against. That is deliberate. An agent can call get_accounts and get_guardrail_status and see the whole safety surface working before you have configured anything.
# no config needed: boots a safe paper demo sandbox uvx pitbridge mcp # scaffold a real config when you are ready uvx pitbridge init # writes ~/.pitbridge/config.toml # then set your account's mode under [accounts.<name>]
When you scaffold a real config, each account carries its own mode. Leave a new one on paper and point it at a simulation account. Everything an agent needs to prove itself, order flow, blocks, the kill switch, the audit trail, happens here first.
Promoting to live is an operator step, not an agent tool
This is the line that matters. There is no MCP tool, no REST call and no config value the agent can reach that moves an account from paper to live. Arming live is a separate ritual you run yourself at the command line. And in the open-source core, that ritual refuses, because live execution is gated behind a provider plugin that the core does not ship.
$ pitbridge arm-live
arm-live refused: no LiveExecutionProvider plugin is installed.
Live trading is gated behind the private pitbridge-pro plugin. This
v0 build is paper/sim only, nothing to arm.The refusal is the feature. An agent that has been prompt-injected, jailbroken or simply told to “go live” has no capability to do so, because the capability does not exist where the model runs. The order pipeline honors the mode gate structurally, and an acceptance test fails the build if any module outside the pipeline can reach the order-submit path.
Check the mode before you connect an agent
You never have to guess which mode an account is in. pitbridge doctor prints a line per section, including each account’s mode and the state of the live gate, so you can confirm live is locked before an agent ever attaches.
- Run pitbridge doctor and read the accounts section: each account shows its mode.
- Confirm the live gate reads locked, so arm-live has nothing to arm.
- Keep a new agent on a paper account pointed at a simulation account such as Sim101.
- Watch a full session in paper: order flow, a blocked order, the kill switch, the audit log.
- Only after that, and only with your firm's rules confirmed, consider a live account.
The short version
A trading agent should earn its way to a real account. Read-only lets it watch, paper lets it trade a simulation account with the full guardrail set live, and live stays locked behind an operator step the agent cannot take. A fresh install is paper only by design, so the safe path is the default path, not something you have to remember to switch on.