{
  "markdown": "# xRocket Exchange MCP\n\n[![Smithery](https://img.shields.io/badge/Smithery-listed-FF6B00)](https://smithery.ai/servers/corefather/xrocket-exchange)\n\nSet one daily value limit, connect an xRocket API token locally, and let an MCP-capable AI agent place and cancel spot orders autonomously inside that limit. Internal transfers and external withdrawals remain separate prepare/approve/execute operations.\n\nThe hosted endpoint is a zero-account market-data demo and onboarding path. Actual account reads and trading run locally with the user's xRocket token. This project is not affiliated with, endorsed by, or operated by xRocket.\n\n[Set up trading](https://xrocket-mcp-production.up.railway.app/#trade) · [Open xRocket](https://t.me/xRocket?start=kaban) · [Try the market demo](https://xrocket-mcp-production.up.railway.app/#demo) · [Official API overview](https://docs.xrocket.exchange/api/exchange/exchange-api-overview) · [Safety model](docs/SAFETY.md) · [Coverage](docs/API_COVERAGE.md) · [Distribution](docs/DISTRIBUTION.md)\n\n## What is included\n\n| Layer | Purpose | Default |\n| --- | --- | --- |\n| MCP server | Semantic tools over the official REST API | `public`, mainnet, read-only |\n| Agent skill | Teaches agents market analysis, bounded autonomous trading, explicit transfer/withdrawal approval, and reconciliation | Read first; stay inside the configured policy |\n| Portable Agent Plugin | Installs the public MCP endpoint and skill in GitHub Copilot CLI and other Agent Plugins-compatible hosts | Public tools only |\n| Gemini CLI extension | Installs the public MCP endpoint directly from GitHub and is eligible for automatic Gallery indexing | Public tools only |\n| Codex / Claude Code plugin | Installs the server and skill together from a repo marketplace | Public tools only |\n| Registry metadata | `server.json` for `io.github.nakazanie-ton/xrocket` | Published in the Official MCP Registry |\n| Hosted endpoint | Public mainnet tools over Streamable HTTP | No install, token, or account access |\n\nThe API surface was re-audited on 2026-08-24 and still covers all **50 Exchange documentation pages**, all **26 OpenAPI operations**, and all **7 WebSocket channels**. The four linked legal PDFs were reviewed separately on 2026-08-07. The current OpenAPI document has canonical SHA-256 `5de074def6ee9f59c7c1d1a2f8a06e1f5e2fafb446ebef58af7168e32813e2a3`. See [the source inventory](docs/API_AUDIT.md).\n\n## Tool profiles\n\n| Profile | Tools | Token | Financial writes |\n| --- | ---: | --- | --- |\n| `public` | 10 public market-data and onboarding tools | Not used | Impossible |\n| `private-read` | Public tools plus 6 account/history tools | Required | Impossible |\n| `full` | Public and private reads, 3 autonomous trading tools, and 4 transfer/withdrawal approval tools | Required | Still disabled until each feature gate is enabled |\n\nFor normal questions, `xrocket_market_snapshot` resolves a symbol or base asset and returns rules, ticker, best bid/ask, recent trades, fees, and an Open xRocket next action in one call. Private mode adds `xrocket_account_overview` for funding balances, trading balances, and active orders without inventing portfolio valuation. Full mode adds autonomous market/limit orders and cancellation inside the local policy; transfers and withdrawals keep their approval receipts.\n\n## Quick start — trade through MCP\n\n1. [Sign in to xRocket](https://t.me/xRocket?start=kaban). In the bot, open **Menu → Settings → Exchange settings → API token**.\n2. Generate a testnet configuration with one daily value limit:\n\n   ```bash\n   npx -y xrocket-mcp@0.6.0 trading-config --limit 100 --asset USD\n   ```\n\n3. Paste the printed JSON into your local MCP client and replace `SET_YOUR_XROCKET_API_TOKEN_LOCALLY` in that client's local secret or environment settings. Do not paste the token into chat, this website, an issue, or a committed file.\n4. Give the agent a strategy:\n\n   > Use xRocket on testnet. Trade GRAM-USDT with this strategy: [describe strategy]. Stay inside the configured daily trading limit. Do not transfer or withdraw funds.\n\n5. The agent can now place and cancel market or limit orders on any available spot pair until the daily limit or the built-in order-count limits are reached.\n\nAfter testing, generate a live configuration with `npx -y xrocket-mcp@0.6.0 trading-config --limit 100 --asset USD --mainnet`. Transfers and withdrawals remain disabled.\n\nThe xRocket API token is a broad bearer credential without documented granular scopes. Local MCP feature gates reduce what this server exposes, but they do not narrow the upstream token itself. Use a trusted local client and protect its configuration like a password.\n\n## Market-data demo — no installation\n\nOpen the [zero-install connection page](https://xrocket-mcp-production.up.railway.app/) or add this URL to any MCP client that supports Streamable HTTP:\n\n```text\nhttps://xrocket-mcp-production.up.railway.app/mcp\n```\n\nGeneric client configuration:\n\n```json\n{\n  \"mcpServers\": {\n    \"xrocket\": {\n      \"url\": \"https://xrocket-mcp-production.up.railway.app/mcp\"\n    }\n  }\n}\n```\n\nThe hosted service is structurally limited to the 10 public mainnet tools. It never reads tokens, account data, or financial-write settings. Its health endpoint is [`/health`](https://xrocket-mcp-production.up.railway.app/health).\n\nFor balances, order history, or autonomous execution, use the local package above. The remote demo cannot be upgraded with a token.\n\n## Local package\n\nRequirements: Node.js 20 or newer. No clone or configuration is needed for public market data:\n\n```bash\nnpx -y xrocket-mcp@0.6.0 doctor\nnpx -y xrocket-mcp@0.6.0 config\n```\n\nThe second command prints this copy-paste MCP client configuration:\n\n```json\n{\n  \"mcpServers\": {\n    \"xrocket\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"xrocket-mcp@0.6.0\"],\n      \"env\": {\n        \"XROCKET_ENVIRONMENT\": \"mainnet\",\n        \"XROCKET_ENABLE_TRADING\": \"false\",\n        \"XROCKET_ENABLE_TRANSFERS\": \"false\",\n        \"XROCKET_ENABLE_WITHDRAWALS\": \"false\",\n        \"XROCKET_ALLOW_MAINNET_WRITES\": \"false\"\n      }\n    }\n  }\n}\n```\n\nThe Codex bundle is described by [`plugins/xrocket-exchange/.codex-plugin/plugin.json`](plugins/xrocket-exchange/.codex-plugin/plugin.json), and its safe defaults are already set in [`plugins/xrocket-exchange/.mcp.json`](plugins/xrocket-exchange/.mcp.json). Register this repository's marketplace, then install the all-in-one plugin:\n\n```bash\ncodex plugin marketplace add nakazanie-ton/myrocket --ref main\ncodex plugin add xrocket-exchange@xrocket-agents\n```\n\nGitHub Copilot CLI can install the portable Agent Plugin directly from its repository subdirectory:\n\n```bash\ncopilot plugin install nakazanie-ton/myrocket:plugins/xrocket-exchange\n```\n\nThis direct install uses the hosted public-only MCP endpoint. Local account access and trading still use the one-limit configuration generated in the quick start above.\n\nGemini CLI can install the root extension directly:\n\n```bash\ngemini extensions install https://github.com/nakazanie-ton/myrocket\n```\n\nThe Gemini extension also starts with the hosted public-only tools and returns the local trading setup when account access is requested.\n\nFor a local clone, replace the first command with `codex plugin marketplace add /absolute/path/to/myrocket`.\n\nClaude Code uses the same public-first bundle through its native marketplace:\n\n```bash\nclaude plugin marketplace add nakazanie-ton/myrocket\nclaude plugin install xrocket-exchange@xrocket-agents\n```\n\nThe installed plugin can inspect live markets immediately. When account access or trading is requested, its skill directs the user to sign in and generate the local configuration with one daily limit; no API token is requested in chat.\n\nFor source development:\n\n```bash\ngit clone https://github.com/nakazanie-ton/myrocket.git\ncd myrocket/plugins/xrocket-exchange\nnpm ci\nnpm test\nnpm run build\n```\n\nThe current package is [`xrocket-mcp@0.6.0`](https://www.npmjs.com/package/xrocket-mcp/v/0.6.0).\n\n## Enabling private reads\n\nCreate an xRocket API token in the signed-in bot and pass it only through the local process environment. With a token present, the profile defaults to `private-read`; an explicit profile is still respected:\n\n```bash\nexport XROCKET_ENVIRONMENT=testnet\nexport XROCKET_API_TOKEN='replace-with-your-token'\nnode dist/cli.js\n```\n\nNever put the bearer token in a prompt, tool argument, committed MCP file, issue, or log. xRocket describes one broad bearer credential rather than fine-grained scopes, so treat it as full account access.\n\n## Enabling a write capability\n\n`full` does not enable writes by itself. Enable only the capability you need:\n\n```bash\nexport XROCKET_PROFILE=full\nexport XROCKET_ENVIRONMENT=testnet\nexport XROCKET_API_TOKEN='replace-with-your-token'\nexport XROCKET_ENABLE_TRADING=true\nexport XROCKET_TRADING_LIMIT='100 USD'\n# XROCKET_ENABLE_TRANSFERS and XROCKET_ENABLE_WITHDRAWALS remain false\nnode dist/cli.js\n```\n\nTrading orders are autonomous:\n\n1. `xrocket_agent_trade` estimates the order, converts its quote value to the configured limit asset, checks the daily value, daily order-count, and active-order limits, reserves the amount durably, and submits once.\n2. `xrocket_agent_cancel` cancels an existing order directly. Cancellation does not need per-order approval.\n3. Unknown placement outcomes remain charged against the limit and are never retried automatically.\n4. All spot symbols are allowed by default. `XROCKET_TRADING_SYMBOLS` is an optional advanced allowlist, not an onboarding requirement.\n\nInternal transfers and external withdrawals still use the exact prepare/approve/execute receipt flow. Their feature gates are off in the generated trading configuration.\n\nMainnet writes additionally require `XROCKET_ENVIRONMENT=mainnet` and `XROCKET_ALLOW_MAINNET_WRITES=true`. See [configuration and safety details](docs/SAFETY.md).\n\n## Important API boundaries\n\n- The Exchange API has **no deposit-address or create-deposit endpoint**. `xrocket_onboarding_links` provides the configured UI path; balances can be refreshed afterward.\n- Exchange `POST /api/v1/accounts/transfers` moves funds only between the same user's `funding` and `trading` accounts. It is not a user-to-user payment tool.\n- xRocket Pay is a different product, uses different authentication, and is outside this server.\n- The official API currently uses asset identifier `TONCOIN` in places where the UI may say TON.\n- The 0.6.0 server uses REST snapshots. WebSocket channels are audited but not exposed until the upstream documentation defines reliable replay, gap recovery, and orderbook delta deletion semantics.\n- Decimal financial values remain strings. Do not coerce them through binary floating point.\n\n## Development\n\n```bash\ncd plugins/xrocket-exchange\nnpm ci\nnpm test\nnpm run typecheck\nnpm run build\nnpm pack --dry-run\n```\n\nCI also checks the recorded documentation inventory and OpenAPI digest for drift. No live private credentials are used in tests.\n\n## Policy and support\n\nThis software can submit trades, transfers, and blockchain withdrawals when a local operator explicitly enables those capabilities. Review [SECURITY.md](SECURITY.md), [PRIVACY.md](PRIVACY.md), [TERMS.md](TERMS.md), the project's [legal and policy review](docs/LEGAL.md), and xRocket's canonical [terms and policies guide](https://docs.xrocket.exchange/api/exchange/guides/terms-and-policies) before use.\n\nOpenAI's public plugin directory rules currently prohibit tools that execute investment trades, money transfers, or cryptocurrency transfers. The full profile is therefore **not eligible** for that public directory. Only the separately built hosted endpoint is a public-directory candidate; it contains no private or financial-write tool registrations.\n\nReport defects through [GitHub Issues](https://github.com/nakazanie-ton/myrocket/issues). Report vulnerabilities privately as described in [SECURITY.md](SECURITY.md).\n",
  "bytes": 11919,
  "sha": "bb677116e72c2a666bdc526f2759bd3a5e45db58b8f1a1939c07ce7f25ba1122",
  "repo_slug": "nakazanie-ton/myrocket",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_nakazanie_ton_xrocket_54ea5739/readme"
}