Working with AI

Malgot does not run its own AI. You bring yours. Malgot supplies the tools; your model decides what to call, and Malgot checks every call against your permissions before it runs.

That has a practical consequence worth stating up front: an AI acting for you can never do more than you can, and usually less. It is not a separate account — it works under your identity, with your permissions and your quota.

Three ways in

| | Where you type | Who pays for the model | Setup | |---|---|---|---| | Claude app | in Claude | your Claude subscription | add a connector, one click | | Claude Code / VS Code | in your editor | your Claude subscription | one command + an API token | | The field in Malgot | in Malgot | your own API key, per use | paste a key into Settings |

A Claude subscription only pays when the conversation happens inside Anthropic's own apps. The moment Malgot calls a model for you, Malgot is the API customer — that is why the third option needs a key of its own. This is not a Malgot limitation; no web app can spend your chat subscription.

1 · The Claude app

The quickest way in, and it costs nothing beyond the subscription you already have.

1. In Claude, open Settings → Connectors → Add custom connector.
2. Enter your Malgot address (for the hosted service: https://malgot.de).
3. Claude opens a Malgot page in your browser. Sign in if asked, then read what is being granted and approve.

You are now connected. Ask "Which strategies do I have in Malgot?" — you should see Claude call a tool, not just answer.

How Malgot knows it is you

Claude never learns your identity. The approval page runs in your browser, where your Malgot session already lives, so the server reads who is approving from your own session — and binds the resulting token to your account. Claude only ever holds an opaque token.

Revoke it any time under Settings → API tokens.

2 · Claude Code (terminal or VS Code)

Same subscription, same tools, but inside your editor. Setup is manual because Claude Code takes MCP servers from its own configuration rather than a connector UI.

1. In Malgot, go to Settings → API tokens and create a token. Pick the scopes you want (see below).
2. Add the server with claude mcp add — run claude mcp --help for the exact flags for your version. The endpoint is https://malgot.de/mcp, authenticated with Authorization: Bearer <your token>.

Because you choose the scopes here yourself, this is the place to grant everything you want without a consent screen in the way.

3 · The field inside Malgot

Under KI in the top bar. This is the only option where the conversation lives next to your objects — a proposed code change appears in the chat with Accept and Discard right there, instead of sending you to the object page.

It needs an API key from the Anthropic Console, which is a different product from a Claude subscription, with its own billing. Create a key there, then paste it into Settings → Account → AI access. It is stored encrypted, the same way your broker credentials are, and never shown again.

What an AI is allowed to do

Permissions come in three levels. You choose them when connecting or when creating a token.

| Scope | What it allows | |---|---| | read | See your objects, runs and results | | draft | Propose code changes as drafts | | enqueue | Start quick sims, backtests and optimizations |

There is no write scope, and there never will be. Writing to a live object is blocked for an AI at every level. An AI proposes; a person accepts.

Drafts: proposed, not applied

When an AI improves a strategy or an indicator, it does not touch the living object. It writes a draft — a separate version that sits outside your version history until you look at it.

You then see the difference between what is live now and what is being proposed, and you decide. Accepting creates a new version credited to you, because you are the one who decided. Rejecting leaves no trace on the object.

This is the single most important thing to understand about AI in Malgot: nothing changes because a model said so.

Starting simulations costs quota

enqueue is the one permission that consumes something. Every quick sim, backtest and optimization counts against your monthly simulation quota — and an AI can work through it considerably faster than you would by hand.

Your plan limit still applies; granting the scope does not raise it. When the quota is gone, the AI is told so in plain language and stops, rather than failing silently.

Grant enqueue when you want the AI to actually test ideas rather than only talk about them. Leave it out if you want it to look and suggest only.

Two cautions the AI is told about

Malgot instructs every connected agent about two traps, because a model that only reports numbers will make both:

Overfitting. Search a strategy long enough and chance alone produces a splendid backtest. Ask the AI how many attempts a strategy's lineage already has behind it, and treat a great number with corresponding suspicion.

Survivorship bias. Library asset groups are snapshots of today's members, so a backtest silently skips companies that have since disappeared — and looks better than reality.

An AI that hands you a Sharpe ratio without mentioning either has not done the job.

Common problems

Claude answers without calling a tool. Then it is guessing. Ask it to list its available tools; an empty list means the connection or the token has no scopes.

"No model access configured." The field in Malgot has no API key yet — Settings → Account → AI access.

"Quota exhausted." The monthly simulation limit is reached. The message names the limit and what was used; it applies to you too, not just to the AI.

The AI wants to change something and cannot. That is by design. Ask it to propose a draft instead — then accept it yourself.