A trading agent hit its $25 limit, and the refusal told it what size would fit

The order that was too big

A developer gave an AI agent access to a trading key, a $25 limit and a request that went over it. As dev.to reported, the agent was Codex CLI (OpenAI's coding agent for the terminal). It asked to short 0.0005 BTC on a perpetual-futures testnet, which is practice trading with no real money. A short is a bet that the price will fall.

That order was worth about $40, over the $25 cap the developer had set for each market. The guardrail refused it, which was expected. What happened next is what the author found interesting.

A refusal that carried the answer

The refusal did not just say no. It said the resulting position would be worth $40.11 and exceeded the cap, and it named the largest size that would fit: 0.00031 BTC.

Six seconds later, Codex planned a short of exactly 0.00031 BTC. The plan passed and the order filled on chain, in block 31576050. The agent's instructions only said to stay within the policy, so the number came entirely from the refusal.

The re-planned short came out at $24.86, with its liquidation point 189.78% away from the current price. Liquidation is when an exchange force-closes a position because losses have eaten the collateral.

Why a plain "denied" falls short

The author's tool is called Pilot, an MCP server he built for a trading bounty on the Somnia testnet. MCP is a standard way for AI agents to call outside tools. The usual approach is to wrap an exchange SDK in a check that throws an error when an order breaks a rule. That blocks the order but leaves the agent knowing only that it failed, so it may guess, retry blindly or hand the problem back to you.

Pilot gives every refusal three jobs. It states which rule broke, using numbers. It names a next step the agent can run as it is. And when nothing can work, it says so plainly, so the agent stops instead of looping.

Making the suggestion trustworthy

A suggested size only helps if it is a real, sendable number, and the author describes two design choices behind that. First, the cap applies to the whole position the order would leave, not just the order. Otherwise five $10 orders would slip past a $25 cap. The suggested size is the remaining room, rounded down to the market's smallest allowed step.

Second, the cap is priced at the worst possible fill. A short sells into existing bids, so valuing it at its own limit price could pass the check and then fill at a higher value. Pricing it at the top bid closes that gap.

The same rule check runs twice, once at planning and again just before sending, using a fresh read of the policy file. If you tighten a limit after a plan is made, the new limit still applies.

When no size fits

The author also tested a harder case. Claude Code was told to add 0.1 SOL to an existing 0.2 SOL position. That was about $10 on its own, but the combined position would be $30.80, over the cap. Only 0.04 SOL of room remained, and the exchange's minimum order is 0.1 SOL.

Suggesting a smaller size would have been a trap, because the agent would plan it, get refused again and loop. So the message says no SOL order fits and points to closing or reducing the position. If the only fix is a higher limit, it tells a human to edit the policy file. No Pilot tool can write to that file, so the agent cannot raise its own limit.

Sending is also gated. A plan returns an ID that lasts 60 seconds and works once, and the send tool accepts only that ID. A second attempt with the same ID is told what happened to the first, which prevents resending an order that already went through.

What the author admits it does not do

The recorded runs include 9 orders opened and closed, 2 brackets, 2 cancels and 15 refusals across 7 different rules, backed by 215 tests. Two agents, Claude Code and Codex CLI, ran against the same server code.

The caveats are real. It has only run on a testnet, and the author recommends a throwaway key. Pilot guards its own tools, not the whole agent, so an agent with shell or file access could edit the policy or read the key. For trading sessions he suggests turning those tools off. Plans are stored in memory and vanish on restart. And the run described used an older version, so the same order today would read about $40.51 with a slightly smaller suggested size.