For agents

Reference: BEST, MCP and the API

1. 1 BEST Integration How BEST, the Behavioral State protocol, exposes dotQuant to AI assistants: the discovery manifest, the command and query catalogues, live event streams and guided workflows. What is BEST? · BEST Discovery Manifest · Command Catalogue · Query Catalogue · Live Event Streams · Guided Workflows
2. 2 Agentic AI Connect Claude, Cursor or any MCP-capable assistant to your account: authentication, onboarding an agent, sending commands and the best-mcp transport. Agentic AI Overview · Agent Authentication · Onboarding an Agent · Sending Commands · MCP Transport
3. 3 Agent Playbook Worked examples of what to ask an assistant connected to dotQuant, and which workflow, commands and queries it uses for each. Follow a New Symbol · Research a Symbol · Organize Your Watchlist · Create a Strategy · Backtest a Strategy · Run a Strategy Live · Fan Out Signals · Design a Portfolio · Manage a Portfolio · Place a Manual Order
4. 4 BaaS API Drive your account from any script or service over HTTP: API-key authentication, rate limits, command schemas, curl examples and the health endpoint. BaaS API Overview · API Key Authentication · Rate Limiting · Command Schemas · curl Examples · System Health

Register as the person's agent

1. 1. Read the manifest JSON, no credential needed. It names the services, what opens each of them and, in its authentication block, the two endpoints an agent registers through. https://baas.dotquant.io/.well-known/best
2. 2. Register yourself Whatever the person said, sign me in, log in, connect me, sign me up, a key stopped working, your part is the same. Signing in is THEIR act, on this site, and dotQuant is invite only, so they need an account already; you register as their agent at the device authorization endpoint the manifest declares, and show them the link and the short code it answers.
3. 3. The person signs in on the activation page dotQuant is invite only: they sign in with the account they already have, then approve you. The page offers no sign-up, so never suggest one.
4. 4. Collect the key at the token endpoint The manifest names it. Keep the key in your client and verify the connection with a read on the account. A configured, verified connection is the outcome; a printed key is not.
5. 5. The rest is in the manifest The account has its own manifest, with its commands, queries, event streams and recipes; each recipe gives its ordered steps and the rules between them. This page does not repeat them, so it cannot disagree with them.

Good to know

An assistant that takes a connector address

Claude, ChatGPT and other assistants with custom connectors need no file and no Node: the address is https://dotquant.io/mcp. The person pastes it, signs in with the browser, approves on the same activation page, and is brought back. The key never appears anywhere.

You sign nobody in

Signing in is the person’s own act, and their approval of you is the point. The Sign in form on the web pages is for people, not for assistants acting on their behalf.

The key is a secret

Store it in the client configuration or credential store and never repeat it in the conversation. A key that appears in a transcript must be treated as leaked and replaced. best-mcp 2.4 and later registers for you, stores the issued key itself and never returns it to the model.

One key per account

Approving a registration replaces any API key the account already had. Tell the person before they approve, especially if another assistant is already connected.

Existing accounts only

dotQuant is invite only: the activation page offers sign in, not sign up. The person signs in with the account they already have and approves, and the key you receive is for that account. Someone without an account cannot get one there; tell them dotQuant is invite only.

Clients that cannot set headers

A browser EventSource or a URL-only integration exchanges the key for a short-lived read-only token at the same token endpoint (RFC 6749 client_credentials: client_id is the tenant id, client_secret is the key) and passes it as access_token on reads and event streams. Such a token can never send commands; the key itself never belongs in a URL.

How BEST works

BEST makes the whole platform self-describing over HTTP. The manifest at /.well-known/best names the services, the authentication and the public surface. On a tenant's surface, GET /commands and GET /queries are the definitive catalogues of what you can do, and GET /workflows lists guided multi-step recipes such as design-a-portfolio and manage-a-portfolio. GET /commands/{name}/{version} returns the JSON Schema of a command. A command is a CloudEvent POSTed to /commands; the 201 means accepted, and outcomes land in the read models and, for some lanes, on the event stream. A query is GET /queries/{name}?param=value and answers synchronously. Nothing needs scraping or out-of-band documentation.

Once you hold a tenant id and its key, send the key as the X-Api-Key header on https://baas.dotquant.io/api/best/tenants/{tenantId}/... from any client that can set a header. If your client can run MCP servers, npx -y @behavioralstate/best-mcp with BEST_DOTQUANT_BASE_URL alone registers for you and exposes the same surface as tools. dotQuant never holds funds, and no order is placed without the person's explicit approval.

Links

• BEST service manifest dotquant.io/.well-known/best redirects to the canonical manifest on baas.dotquant.io.
• User documentation How to use dotQuant screen by screen, with the stock research guides and video walkthroughs.
• BEST protocol specification behavioralstate.io