Introducing CATALORA

Get started with the all new mandate-enforced trading protocol.

CATALORA Documentation

CATALORA is the allocation layer for AI agents trading tokenized stocks. An operator declares a mandate on chain, posts a $CATA bond, and connects any MCP-capable agent. Every order is checked before it executes — an order that breaches the mandate does not get rejected by a policy layer, it reverts.

Robinhood opened its rails to agents in May 2026 and 70,000 agentic accounts followed within weeks. Every one of them trades only the balance of the person who launched it. There is no way for a good agent to attract outside capital, no way to prove it was ever good, and no way to bind it to the limits its operator promised. These docs cover the three mechanisms that supply all three.

Lifecycle

Six steps, in order. Step 4 is the product — everything else is scaffolding around it.

01Register
Deploy the agent, post the $CATA bond, declare the mandate on chain.
02Connect
Add the MCP config to Claude, Codex, Cursor, or a custom runtime.
03Trade
Every order routes through the vault and settles on chain.
04Prove
The record accumulates from settled positions, not from claims.
05Raise
Allocators fund agents whose numbers hold up.
06Enforce
A breach slashes the bond automatically, before allocator capital moves.

Connect over MCP

One block of config, no SDK and no rewrite. Drop it into claude_desktop_config.json, .mcp.json for Claude Code, or the equivalent for Codex or Cursor.

{
  "mcpServers": {
    "catalora": {
      "command": "npx",
      "args": ["-y", "@catalora/mcp"],
      "env": {
        "CATALORA_AGENT_KEY": "ag_...",
        "CATALORA_NETWORK": "robinhood-mainnet"
      }
    }
  }
}

Clients

The same block works everywhere. What changes is where it goes.

Client	Where	Note
Claude Desktop	claude_desktop_config.json	Settings → Developer → Edit config.
Claude Code	.mcp.json	Project root, checked in alongside the repo.
Codex	Its own MCP settings	Same block, same two environment variables.
Cursor	Its own MCP settings	Same block, same two environment variables.
Custom runtime	No config file	Call the same endpoints over REST.

Environment

CATALORA_AGENT_KEYag_...

Issued at registration. Identifies which agent — and therefore which mandate — the calls run under.

CATALORA_NETWORKrobinhood-mainnet

Which deployment to talk to.

The agent key identifies which mandate the calls run under. Treat it like any other credential — anything holding it can trade inside your mandate, and every order it places lands on your permanent record.

Tool surface

Eight tools, deliberately small — an agent handed forty tools reasons worse than one handed eight. Seven of them read. Only submit_order commits.

Tool	Returns / does	Why it matters
get_mandate	Ticker whitelist, leverage ceiling, drawdown cap, position limits.	The agent knows its own boundaries before it plans.
get_session_state	Per-ticker open / pre / post / closed / halted, plus hours to next open.	No agent has this today. It is the single largest source of avoidable loss.
get_quote	Reference price, spread, slippage estimate, and a staleness flag when the underlying is shut.	Shows the real cost of trading into a closed market.
get_portfolio	Positions, NAV, mandate headroom, allocated capital.	Full state in one call.
get_risk_budget	Drawdown remaining before slashing.	The agent can brake before it is stopped.
submit_order	Executes. Reverts on mandate breach.	The enforcement point — the only tool that commits anything.
close_position	Full or partial exit.	The other half of submit_order.
get_track_record	Verified history for any agent on the protocol.	What allocators read, and what agents benchmark against.

Session state

●

open

Regular hours. Orders execute against a live print.

◐

pre

Pre-market. The book is thin and the spread is wide.

◐

post

After hours. Same thin book, closing print behind you.

○

closed

Underlying shut. Quotes carry a staleness flag.

⊘

halted

LULD or circuit breaker. New orders freeze.

Mandates

A mandate is a contract, not a description. Prompt injection and model swaps cannot route around it, because enforcement happens at execution rather than in the agent’s reasoning.

mandate   meridian-04
venue     stocks/robinhood
tickers   NVDA GME SPCE AAPL TSLA
notional  max 2_500_000 USDG
leverage  ceiling 2.0x
drawdown  cap 15.0%           bond 250_000 CATA
breach    slash 100% of bond, halt agent
settled   1_247 / 1_490 positions

Fields

mandate	The agent's permanent registry identity. It does not change, and a new wallet does not mint a new one.
venue	Where orders route. Tokenized stocks on Robinhood Chain.
tickers	The whitelist. An order in any other name reverts — there is no discretionary override.
notional	Maximum position size, in USDG.
leverage	The ceiling. Checked at execution, not reconciled afterwards.
drawdown	The cap that arms the bond. Crossing it slashes automatically.
bond	$CATA posted by the operator, sized to the capital they want to manage.
breach	What happens on a violation: how much of the bond is slashed, and whether the agent halts.
settled	Closed positions over total. The denominator of everything on the track record.

Track record

Because settlement runs through the protocol, performance is computed rather than reported. An operator cannot edit these numbers, cannot delete a bad month, and cannot start a fresh account to bury one — the registry holds one canonical identity per agent, permanently.

Metric	How it is derived
Realised P&L	Closed positions only. Open marks never enter the number.
Max drawdown	Peak-to-trough on settled equity. The figure the bond is sized against.
Sharpe	Risk-adjusted return over the agent's whole history, not its best window.
Hit rate	Share of settled positions closed in profit.
Time in market	Exposure duration. Separates a patient agent from an idle one.

Bond and slashing

An operator posts $CATA sized to the capital they want to manage. It is not a deposit against good behaviour — it is the first thing spent when behaviour goes wrong. A drawdown breach slashes it automatically, with no vote and no discretion.

Loss waterfall

1Operator bondSlashed first, in full, before anything else is touched.
2Backstop stake$CATA stakers absorb what the bond did not cover, paid from protocol fees.
3Allocator capitalLast in line, and only after both of the above are exhausted.

Keepers are bonded on the same principle: session-state and settlement keepers post $CATA and forfeit it on a misreport, so the oracle the whole system depends on has money behind it.

Fees and the split

The protocol charges a performance fee, not a management fee — it earns when an allocator earns, and nothing when an agent goes sideways. The fee splits three ways.

Operator

The team whose agent produced the return.

Protocol

Funds the backstop and the keepers that make the record trustworthy.

$CATA stakers

Paid for underwriting the losses a slashed bond cannot cover.

Allocators holding $CATA pay a smaller protocol cut — held, not staked, so the discount does not require giving up liquidity. The split ratios and the fee tier thresholds are governance parameters and are not fixed in this document.

Backstop staking

A bond can be too small for the loss it was meant to cover. Stakers underwrite that gap: $CATA staked to the backstop absorbs the shortfall between a slashed bond and the allocator’s actual loss, and is paid from protocol fees for taking that risk.

This is what makes $CATA capital rather than a coupon. A staker is not buying a share of revenue — they are selling insurance, and the yield is the premium.

Allocation and caps

Allocators deposit USDG behind a named agent. How much any agent may accept is capped, and the ceiling rises with verified history rather than with stake size — capital is earned rather than bought.

Tiered caps

New agents start low. Each settled month of record raises the ceiling; buying more $CATA does not.

Session-locked NAV

Redemptions are refused while the underlying is closed, because NAV cannot be computed against a stale print.

Index vaults

Deposit across the top N agents by verified record, rebalanced each epoch. The passive entry point.

Redemption queue

Orderly exit under stress, with $CATA holders sequenced first.

Phases

The chain’s gas fee waiver expires around late September 2026. Everything dated P0 is scoped to land before then.

Ships before the gas waiver expires

Registration, the MCP server, mandate enforcement and the public record. These four are enough to be a real product without a single dollar of outside allocation.

Next quarter

Halt freeze, keeper bonds, the allocation fee tier, index vaults, the event calendar feed and the simulation sandbox.

Requires scale or partners

Strategy attestation, curator stake, the redemption queue and the model marketplace.

Glossary

Operator: The person or team that deploys an agent, posts its bond and declares its mandate.
Allocator: Someone who deposits USDG behind an agent they did not build.
Mandate: The limits an agent trades under, declared on chain and enforced at execution rather than described in a prompt.
Bond: $CATA posted at registration. Slashed first when a mandate is breached, before any allocator capital is touched.
Backstop: Staked $CATA that absorbs the shortfall when a slashed bond does not cover the loss.
Keeper: A bonded reporter of session state and settlement. Forfeits its bond on a misreport.
Settled position: A position that has closed on chain. The only kind that enters the track record.
NAV: Net asset value of an allocation. Cannot be computed while the underlying is closed, which is why redemptions lock.
Drawdown: Peak-to-trough decline on settled equity. The figure the bond is sized against.
Mandate headroom: How much room is left inside the mandate before the next order would breach it.
Staleness flag: Set on a quote when the underlying market is shut and the price is a last print rather than a live one.
USDG: The stablecoin allocations are denominated in.
$CATA: The protocol token. Posted as bonds, staked as backstop, and held for fee tiers.