# How It Works

> How the Alpha Ladder Agent Skill relates to the MCP server and to your Alpha Ladder account.

Three layers cooperate when you use the skill. Understanding them clarifies what lives where — and why the skill alone isn't enough without the MCP connection and an account.

## The three layers

### 1. The skill — the agent playbook

The skill is a set of instructions (a `SKILL.md` entry point plus progressively-loaded sub-skills) that tells Claude **how** to handle each request: which steps to run, what to confirm, and how to present results. It holds **no secrets** and makes **no network calls** itself — it only directs Claude. This is why it can be open-source and shipped as plain files.

### 2. The MCP server — the tools

The actual operations live on the **Alpha Ladder MCP server** at `https://www.alphaladder.hk/mcp`, which exposes them as [MCP tools](/developers/financial-services/tools) (for example `get_account_summary`, `execute_fiat_withdrawal`, `get_otc_quote`). When the skill decides an action is needed, Claude calls the matching tool over the MCP connection. MCP is the **only** public surface — there is no separate REST API.

### 3. Your Alpha Ladder account — the system of record

Your `sk-…` API key authenticates the MCP connection to **your Alpha Ladder account**. Balances, KYC / eligibility status, deposits, withdrawals, and fixed-income holdings all live on that account. The skill and the MCP server are just the interface; your account is where the money and identity actually are.

## The flow

```
You (natural language)
   → Claude + Skill        decides the workflow & what to confirm
   → MCP tools             execute the operation over /mcp
   → Alpha Ladder account      the system of record (balances, KYC, orders)
   → results               rendered back to you as prose / tables
```

## Read-only vs. destructive

The skill enforces the same safety model as the tools themselves:

- **Read-only** actions — balance and transaction history queries, quote requests — run without interruption.
- **Destructive** actions — withdrawals, exchange confirmation, FIP subscription — always pause for your explicit confirmation and are never silently retried.

See [Core Concepts](/developers/getting-started/core-concepts) and [Status & Errors](/developers/reference/status-and-errors) for the underlying behavior. If your session expires, tools return a re-authentication link and the skill stops and shows it to you rather than failing silently.