> ## Documentation Index > Fetch the complete documentation index at: https://docs.derive.xyz/llms.txt > Use this file to discover all available pages before exploring further. # Market Maker Protections on Derive > MMP configuration, cancel-on-disconnect, the mmp order flag, and open-orders margin: the safety net for programmatic traders. The Derive API provides three complementary protections for market makers trading large amounts programmatically: 1. **MMP config** — auto-cancels quotes and freezes trading when fills breach configured thresholds within a rolling window. 2. **Cancel on disconnect** — automatically cancels resting orders if the WebSocket connection drops. 3. **Open-orders margin efficiency** — orders marked `mmp=true` receive tighter margin calculations that respect the MMP limits. Combined, these give a market maker a network-level, fill-level, and margin-level safety net against unexpected outcomes. ## MMP config MMP config is a subaccount-wide setting that sets **max amount** or **delta** limits per currency for each subaccount. The matching engine blocks orderbook crosses that would breach these limits, provided: * The `mmp` field is set to `true` on `private/order` (or on the RFQ quote), and * MMPs have been turned on via `private/set_mmp_config`. ### Three benefits to using MMP On engine restart, all orders marked `mmp=true` do NOT persist, protecting against engine downtime. The risk engine takes MMP limits into account when calculating your open-orders margin. Orders with `mmp=true` have a **3× lower rate limit cost** than normal orders. In addition to calling `private/set_mmp_config`, order params must also be set to `mmp=true` for a given order to be tracked by MMP. For the full V3 configuration model, field definitions, and the `set_mmp_config`, `get_mmp_config`, and `reset_mmp` methods, see: Complete V3 MMP reference: field semantics, examples in TypeScript, Python, Rust, and cURL. ## Cancel on disconnect Cancel on disconnect (COD) is a wallet-wide setting that forces the WebSocket servers to cancel all standing orders when a connection drops. It complements MMP: * MMP reacts to fills breaching your thresholds. * COD reacts to losing the session entirely. Both are recommended for programmatic market makers. How COD works, how to enable it with `private/set_cancel_on_disconnect`, and required scopes. ## Open-orders margin Limit orders that stay open in the book require the account to hold extra margin to cover them if they were to get filled. The orderbook backend inspects the account's open orders `[order_1, order_2, ...]` and finds a "worst subset": the set of orders that, if filled, leads to the smallest *initial margin* possible. When performing those simulated fills, the backend takes into account the premiums paid or received for option bids and asks and the current positions owned by the account. **Example.** Suppose the open orders and positions are: * Orders: `[bid 10 perps @ $1999, ask 100 perps @ $2001, bid 10 1w calls @ $55, bid 5 2w calls @ $75]` * Positions: `[long 90 perps]` The backend groups the orders by delta and/or vega sign and concludes that `[bid 10 perps @ $1999, bid 10 calls @ $55, bid 5 2w calls @ $75]` is the worst fill scenario. The open-order margin for these orders is then calculated by finding how much *extra initial margin* the account would require if those orders were filled. For every new open (non-crossing) order arriving at the orderbook, the risk engine checks that the sum of current initial margin and the open-orders margin is non-negative. In other words, new orders are accepted as long as the account can honour the worst-fill scenario. The [`private/get_subaccount`](https://docs.derive.xyz/api-reference/private-get-subaccount) endpoint can be used to check which orders have been flagged as "worst subset" and how much open-orders margin they require. ### MMPs and open-orders margin Portfolio-margin market makers often quote hundreds of assets at once. With tight MMP limits it is impossible to be filled on all quotes simultaneously, so requiring margin for very large subsets of orders would be unreasonably capital-inefficient. For portfolio-margin accounts, the process of finding the worst subset is **constrained by the account's MMP settings**. When MMP amount limits are enabled, the worst subset is reduced to an orders subset that can be filled subject to staying within the MMP amount limit. The reduced subset cannot be smaller than 2 distinct assets: the smallest possible open-orders-margin requirement still enforces that the market maker can honour at least 2 fills on two of the worst assets they are quoting. Using the example above, if the MMP amount limit is 3, the worst subset excludes `bid 5 2w calls @ $75` and consists of `[bid 10 perps @ $1999, bid 10 calls @ $55]`, because at least 2 assets must be fillable. If the MMP limit were high enough (e.g. 30), the subset would remain unchanged. Only the MMP **amount** limit contributes to this capital-efficiency improvement. The **delta** limit is ignored for open-orders margin. See the [`private/set_mmp_config`](/trading/market-maker-protection) reference for the fields. ## Managers and risk universes Portfolio-margin behaviour, including which assets an account can hold and how open-orders margin is calculated, is set by the account's **manager** and **risk universe**. See the [Managers & Risk Universes](/trading/managers-and-risk-universes) reference for how to pick the right manager for your strategy. ## Related V3 API: fields, examples, and reset flow. Toggle the wallet-wide COD setting. Order flags including the per-order `mmp` field. Higher matching-engine limits for program participants. ## Related topics - [Market Maker Protection](/trading/market-maker-protection.md) - [Institutional Trading Rewards Program](/integrators/programs/institutional-trading-rewards.md) - [Integrators and Market Makers](/integrators/introduction.md)