Skip to main content

Can ChatGPT or Claude manage your crypto? What works today

Short answer: an AI assistant can now research, explain, and initiate a lot of what happens to your crypto — and it still cannot sign a transaction for you unless you hand it a key, which you should not do.

The gap between those two facts is where everything interesting is happening. This page covers what actually works today, what does not, and the risks that do not disappear just because the interface is a conversation.

What a chat assistant can do on its own​

Nothing onchain. A language model has no wallet, no key, and no network access to a blockchain by default. On its own it can:

  • Explain a mechanism — what funding rates are, why a delta-neutral position has two legs, what a liquidation price means.
  • Reason about a screenshot, a position, or a strategy you describe.
  • Draft code you then run yourself.

It cannot check your balance, place an order, or move a dollar. Any product claiming otherwise is describing an integration, not the model.

What changed: MCP​

The Model Context Protocol is an open standard for connecting an assistant to an external system through a defined set of tools. Instead of the model guessing, it calls a named tool with typed parameters and gets a structured answer back.

That turns "explain funding rates" into "show me the live agents, their current APY, and what $5,000 would earn over a year" — a real query against real data, answered inside the conversation.

The three tiers of what an assistant can touch​

Not all tool access is the same, and the distinction is the whole safety story.

TierWhat it doesWhat it needs from youRisk if it goes wrong
Read-onlyLook up facts, list options, simulate outcomesNothingA wrong answer
Scoped and authorizedInitiate an action within permissions you grantedA one-time sign-in, scope by scopeAction inside the granted scope only
Key custodyHold a private key and sign freelyYour private keyTotal, irreversible loss

The third tier is the one to refuse. An assistant that holds your private key can be talked into anything by any text it reads, and there is no recovery.

How this works at Deploy Finance​

Deploy Finance runs an MCP server at https://mcp.deploy.finance/mcp. It is built to stay entirely in the first two tiers.

Read-only, no sign-in required. Ask what Deploy is (what_is_deploy), how the deposit-to-withdrawal lifecycle works (how_yield_works), browse every live agent with its chain and risk tier (list_agents), or project what an amount could earn (simulate_yield). These answer instantly and touch nothing.

Scoped, after a one-time OAuth sign-in. Funding tools cover depositing USDC on Arbitrum directly, or sending a supported asset from any of about 13 chains with a quoted fee and expiry before you confirm. Agent tools cover allocating USDC to a strategy, checking your portfolio from live onchain data, exiting an agent, and withdrawing to an external address.

The signature is always yours. The MCP server never holds or requests your private key. Any tool that moves funds validates the details, confirms them in the chat, and then opens a Deploy web app page where you approve the actual transaction with your own wallet. The conversation prepares the action. You authorize it.

Underneath, the agent itself operates the same way: it holds a scoped session key that can open, close, and manage positions but cannot transfer or withdraw funds, and it expires automatically. See Deploy Finance wallets for how the key is stored and exported.

What still does not work, honestly​

The assistant cannot judge the market for you. simulate_yield returns an estimate built on current conditions. It is not a forecast, and funding rates can compress or invert.

It can be wrong with total confidence. A model that misreads a number in a tool response will state the wrong number fluently. Check anything you are about to act on against the app.

Prompt injection is a live risk. If an assistant reads untrusted content — a webpage, a token name, a pasted message — that content can contain instructions aimed at the model. This is exactly why the tiers above matter: a scoped, human-approved signature step means a successful injection still cannot drain a wallet. An assistant holding a private key has no such backstop.

Session context is not memory of your finances. A new conversation does not know what you did last week. Your portfolio state lives onchain and in the app, not in the chat.

What good AI-and-crypto access looks like​

If you are evaluating any assistant integration that touches funds, the checklist is short:

  • Does it ever ask for a private key or seed phrase? If yes, stop.
  • Are read actions separated from write actions, with sign-in required only for writes?
  • Is there a human approval step on the actual signature, outside the model's control?
  • Are the permissions scoped to specific actions, and can you revoke them yourself?
  • Can you export your keys and leave?

A conversational interface does not change the underlying risk. Allocating through an assistant carries the same market, liquidation, funding, venue, and smart-contract risk as allocating through an app. Read Risks before you allocate, in whichever interface you use.

Learn more​

Start with Deploy Finance​

Create a self-custodial Deploy Finance wallet and review the live agents.