Confidential OTC desk on Canton
Get a price without telling the market.
Every order you post is information someone trades against. Cessio is an OTC desk on Canton: request quotes privately from the makers you pick, settle atomically, and leave no footprint — for any token, at any size.
One desk, two kinds of trader: a browser for people, an MCP server for AI agents. Same API, same rules, no privileged client.
cBTC · cETH · Canton Coin — and every other token-standard asset in the desk catalog.
Why trade over the counter
An order book is a broadcast
The moment your interest is public it is priced. Size moves the book before it fills, and the market learns your intent for free.
OTC today runs on chat
Voice and chat desks keep the price private, then hand you manual settlement, a broker in the middle, and a counterparty who has to be trusted to deliver.
Most tokens have no book at all
Outside a handful of majors there is no depth to hit. A negotiated price from a real counterparty beats a thin curve or a bridge hop.
How it works
01
Say what you want to trade
Pick any pair in the desk catalog and the amount. Any size — the desk has no minimum ticket.
02
Choose who gets to see it
Select the makers who receive the request. Nobody else does: not the other makers, not the network.
03
Watch firm quotes arrive
Quotes stream in live with a countdown. Each one is the maker's own signed commitment, already on the ledger — not an indication.
04
Accept, and it's settled
Accepting signs and executes both legs in a single Canton transaction, with an update id you can verify. Losing makers never learn the price, the size, or that a trade happened.
What you get
Any token-standard pair
The catalog is driven by the asset registries, not a hardcoded list — cBTC, cETH, Canton Coin and every other token-standard asset the desk indexes.
Firm quotes, not indications
Every quote is a maker-signed commitment sitting on the ledger. Accepting it is the trade: no last look, no re-quote, no chasing a fill.
Atomic delivery-versus-payment
Both legs execute in one Canton transaction. It happens in full or not at all — there is no window where one side is exposed.
Nothing leaks, by construction
Privacy here is not a policy, it is who the ledger tells. Only the counterparties see the trade; the market never learns it happened.
Self-custody by design
Your party key is generated in this browser and never leaves it. A passkey wraps the encrypted copy we hold — we cannot decrypt it — and your backup phrase restores everything.
Human or agent, one surface
People get no privileged client and agents get no separate sandbox: the same API, the same rails, the same settlement path.
Who trades here
People
Trade from the browser desk.
- Passkey sign-in; your key never leaves the device
- Pick which makers see each request
- Firm quotes with a live countdown
- Verifiable receipts for every settled trade
Bots
Quote programmatically over the Maker API.
- Self-serve registration, issued key, hashed at rest
- REST for actions, WebSocket for the RFQ stream
- Sign and post quotes with your own key
- Quickstart and full reference in the docs
AI agents
Hand the desk to an agent, on rails you set.
- Local MCP server, stdio — works in any MCP client
- The agent holds its own key and its own identity
- Trades as taker, as maker, or both
- Notional cap, instrument whitelist, price-deviation cap
Your agent can trade this desk
AI agents are first-class traders here, not a bolt-on. Point an MCP client at the local Cessio server and your agent has its own identity, its own key, and both sides of the market.
Drop-in MCP server
Runs locally over stdio, so it works in any MCP client. Fourteen tools across three groups: Info, Taker, Maker.
Its own identity, not yours
The agent holds its own Ed25519 key and self-registers with the desk. It signs its own trades; you never hand over your key.
Both sides of the market
Request quotes as a taker, or make markets in a loop: wait for an RFQ, decide a price, submit the quote.
Rails you set, enforced locally
A max notional — leave it unset and the agent is read-only — an instrument whitelist, and a cap on deviation from the reference price. A breach returns a structured error and signs nothing.
- Info
- get_status · get_balances · list_instruments · get_reference_price · request_faucet
- Taker
- create_rfq · list_my_rfqs · get_quotes · accept_quote · cancel_rfq
- Maker
- wait_for_rfq · submit_quote · list_maker_trades · list_trades
How it compares
| Criterion | Cessio | DEX / AMM | CEX order book | Chat OTC |
|---|---|---|---|---|
| Who sees your order | Only the makers you pick | Everyone, plus the mempool | The book, then the tape | The desk, and whoever they tell |
| Price you get | Firm quote, signed up front | Curve price minus slippage and MEV | Depth-dependent, moves as you fill | Negotiated, often re-quoted |
| Settlement risk | None — one atomic transaction | None, but the price can move under you | Custodial until you withdraw | Trust, or an escrow agent |
| Asset coverage | Any token-standard asset in the catalog | Whatever has a pool | Whatever is listed | Whatever the desk carries |
| Who you trade with | Makers you choose per request | An anonymous pool | Anonymous flow | The one desk you called |
| Onboarding | Self-serve, keys stay yours | Self-serve | KYC and deposits | Relationship and paperwork |
| Automation | REST, WebSocket, MCP | Contract calls | Exchange API | Humans on a keyboard |
Fees, plainly
Takers pay nothing
You pay the price on the quote you accepted. That's it.
Makers pay a desk fee in bps
Charged per ticket and stepped down as USD notional grows: bigger tickets, tighter fee.
The fee settles with the trade
It moves in the same atomic transaction as the swap, so there is no invoice and nothing to reconcile.
The exact schedule lives in the maker docs →
Questions
Do I need anything before I can trade?
An account and a funded party on the desk. Sign-up generates your key in the browser and a passkey unlocks it; there is nothing to install.
Who can see my trade?
The makers you selected see the request; the winner sees the trade. Everyone else — other makers, other users, the wider network — sees nothing, including whether a trade happened at all.
What if nobody quotes me?
The RFQ expires and nothing happens. You are never obliged to trade, and no maker is obliged to quote.
What if a quote expires while I'm deciding?
It stops being acceptable and drops off the list. Quotes are live commitments with a countdown, so they never go stale in either direction.
Can I be a maker?
Yes, self-serve: register over the API, get an issued key, subscribe to RFQs and post signed quotes. The docs have a bot quickstart.
Can I let an AI agent trade for me?
Yes. Run the MCP server locally and your agent trades with its own key and its own identity — as taker, as maker, or both.
What stops an agent doing something dumb?
Rails you configure: a max notional per trade, an instrument whitelist, and a cap on how far from the reference price it may go. Leave the notional unset and it can only read.
What happens if I lose my device?
Your backup phrase restores the key on a new device. We hold only an encrypted copy we cannot decrypt, so the phrase is the one thing worth keeping safe.