{ "markdown": "# @traderouter/trade-router-mcp\n\n\n\nA [Model Context Protocol](https://modelcontextprotocol.io) server for [TradeRouter.ai](https://traderouter.ai) — non-custodial Solana swap, limit, trailing, DCA, TWAP, and combo-order engine for AI agents.\n\n[![Security: non-custodial](https://img.shields.io/badge/Security-Non%20Custodial-green.svg)](./SECURITY.md)\n[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](./LICENSE)\n[![npm](https://img.shields.io/npm/v/@traderouter/trade-router-mcp.svg)](https://www.npmjs.com/package/@traderouter/trade-router-mcp)\n[![Awesome MCP Servers](https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/badge.svg)](https://github.com/punkpeye/awesome-mcp-servers#-finance--fintech)\n[![Glama MCP Server](https://glama.ai/mcp/servers/@traderouter/trade-router-mcp/badges/score.svg)](https://glama.ai/mcp/servers/@traderouter/trade-router-mcp)\n[![MCP Registry](https://img.shields.io/badge/MCP%20Registry-ai.traderouter%2Ftrade--router--mcp-blue.svg)](https://registry.modelcontextprotocol.io/v0/servers?search=trade-router)\n\n## Is this safe?\n\n**Yes, and here's exactly why.** The private key is read once from `TRADEROUTER_PRIVATE_KEY`, used for local signing with `@solana/web3.js` + `tweetnacl`, and never transmitted, logged, or persisted. Only signed transactions leave your machine. Server messages are Ed25519-verified against a hard-coded trust anchor. See [SECURITY.md](./SECURITY.md) for the full threat model, data-flow diagram, and permissions manifest.\n\n**Signing flow:**\n\n1. Agent calls `build_swap` → MCP sends wallet *address* (public key) to api.traderouter.ai\n2. API returns an **unsigned** transaction\n3. **MCP signs the tx locally** using `TRADEROUTER_PRIVATE_KEY`\n4. The *signed* transaction is submitted to `/protect` (Jito MEV-protected bundle)\n5. Server confirms and returns balance changes. The private key never crosses the network.\n\n## Requirements\n\n- Node.js ≥ 18\n- A Solana wallet private key in base58 format (use a dedicated trading wallet, not your main holdings)\n\n## Install\n\n```bash\nnpx -y @traderouter/trade-router-mcp\n```\n\nOr wire it into an MCP client (Claude Desktop, Cursor, Cline, etc.):\n\n```json\n{\n \"mcpServers\": {\n \"traderouter\": {\n \"command\": \"npx\",\n \"args\": [\"-y\", \"@traderouter/trade-router-mcp\"],\n \"env\": {\n \"TRADEROUTER_PRIVATE_KEY\": \"your_base58_private_key\"\n }\n }\n }\n}\n```\n\n| OS | Claude Desktop config path |\n|---------|---------------------------------------------------------------------|\n| macOS | `~/Library/Application Support/Claude/claude_desktop_config.json` |\n| Windows | `%APPDATA%\\Claude\\claude_desktop_config.json` |\n| Linux | `~/.config/Claude/claude_desktop_config.json` |\n\n## Environment variables\n\n| Variable | Required | Default | Purpose |\n|---|---|---|---|\n| `TRADEROUTER_PRIVATE_KEY` | ✅ | — | Solana wallet private key (base58). Local use only. |\n| `SOLANA_RPC_URL` | ❌ | `https://api.mainnet-beta.solana.com` | Custom RPC for reads |\n| `TRADEROUTER_SERVER_PUBKEY` | ❌ | baked-in trust anchor | Override the server's Ed25519 trust anchor |\n| `TRADEROUTER_SERVER_PUBKEY_NEXT` | ❌ | *(unset)* | Accept messages signed by this key in addition to the primary (key rotation) |\n| `TRADEROUTER_REQUIRE_SERVER_SIGNATURE` | ❌ | `true` | Verify server signatures on `order_filled` / `twap_execution` |\n| `TRADEROUTER_REQUIRE_ORDER_CREATED_SIGNATURE` | ❌ | `true` | Verify server signatures on `order_created` |\n| `TRADEROUTER_DRY_RUN` | ❌ | `false` | When `true`, every write-action tool (`submit_signed_swap`, `auto_swap`, `place_*_order`, `cancel_order`, `extend_order`) returns `{ dry_run: true, tool, args }` instead of calling the API. Read-only tools execute normally. Added in 1.0.9. |\n\n## Tools\n\n| Tool | Purpose |\n|---|---|\n| `get_wallet_address` | Get the configured wallet's public address |\n| `build_swap` | Build an unsigned swap transaction |\n| `submit_signed_swap` | Submit a manually signed transaction |\n| `auto_swap` | Build + sign + submit in one call |\n| `get_holdings` | Get token holdings for a wallet |\n| `get_mcap` | Market cap and price for a token |\n| `get_flex_card` | Trade card PNG URL for wallet + token |\n| `place_limit_order` | Limit buy/sell by price or market cap |\n| `place_trailing_order` | Trailing stop buy/sell |\n| `place_twap_order` | TWAP (time-weighted) buy/sell |\n| `place_limit_twap_order` | Limit trigger → TWAP execution |\n| `place_trailing_twap_order` | Trailing trigger → TWAP execution |\n| `place_limit_trailing_order` | Limit trigger → trailing execution (single swap on trigger) |\n| `place_limit_trailing_twap_order` | Limit trigger → trailing trigger → TWAP execution |\n| `list_orders` | List active orders for a wallet |\n| `check_order` | Get status of a specific order |\n| `cancel_order` | Cancel an active order |\n| `extend_order` | Extend an order's expiry |\n| `connect_websocket` | Register a wallet over the persistent WebSocket |\n| `connection_status` | Current WebSocket connection state |\n| `get_fill_log` | Log of filled orders |\n\n## REST endpoints (under the hood)\n\n| Endpoint | Purpose |\n|---|---|\n| `POST /swap` | Build unsigned swap (multi-DEX: Raydium, PumpSwap, Orca, Meteora) |\n| `POST /protect` | Submit signed tx via Jito bundle — MEV-protected |\n| `POST /holdings` | Wallet scan — catches tokens standard RPC misses |\n| `GET /mcap` | Market cap + price |\n| `GET /flex` | Trade card PNG generation |\n| `wss://api.traderouter.ai/ws` | Persistent WebSocket for limits / trailing / DCA / TWAP / combo orders |\n\n## Trust anchor\n\nThe baked-in server public key is `EXX3nRzfDUvbjZSmxFzHDdiSYeGVP1EGr77iziFZ4Jd4`. Every `order_filled`, `order_created`, and `twap_execution` message from the server is verified with Ed25519 before being treated as authoritative. See [SECURITY.md](./SECURITY.md) for details and the rotation mechanism (`TRADEROUTER_SERVER_PUBKEY_NEXT`).\n\n## Use with LangChain\n\nAny MCP server works in LangChain via the official adapter:\n\n```python\nfrom langchain_mcp_adapters.client import MultiServerMCPClient\n\nclient = MultiServerMCPClient({\n \"traderouter\": {\n \"command\": \"npx\",\n \"args\": [\"-y\", \"@traderouter/trade-router-mcp\"],\n \"transport\": \"stdio\",\n \"env\": {\"TRADEROUTER_PRIVATE_KEY\": \"\"},\n },\n})\ntools = await client.get_tools()\n```\n\n## Fees\n\nFlat **1% fee on swap volume**, embedded in routing at `/protect`. No subscription, no API key, no monthly minimums. Read-only endpoints (`/holdings`, `/mcap`) are free.\n\n## Machine-readable specs (live on traderouter.ai)\n\n| URL | Format | Purpose |\n|---|---|---|\n| | OpenAPI 3.1 (JSON) | Canonical API contract — generate SDKs in any language |\n| | OpenAPI 3.1 (YAML) | Same spec, YAML format (regenerated from the JSON) |\n| | text | LLM-readable API guide (per [llmstxt.org](https://llmstxt.org/)) |\n| | markdown | Anthropic Agent Skills format — full implementation guide |\n| | markdown | Threat model + data-flow diagram + permissions manifest (mirrors [./SECURITY.md](./SECURITY.md) here) |\n| | markdown | Unified changelog across the API / MCP server / Site version tracks |\n\nQuick SDK generation:\n\n```bash\n# TypeScript\nopenapi-generator-cli generate -i https://traderouter.ai/openapi.yaml -g typescript-axios -o ./sdk-ts\n\n# Python\nopenapi-generator-cli generate -i https://traderouter.ai/openapi.yaml -g python -o ./sdk-py\n```\n\n## Security disclosure\n\nEmail **security@traderouter.ai** or use GitHub Security Advisories on this repo. 48-hour acknowledgement. See [SECURITY.md](./SECURITY.md) (or the [hosted version](https://traderouter.ai/SECURITY.md) if you'd rather link to a stable URL).\n\n## License\n\nMIT. See [LICENSE](./LICENSE).\n\n## Changelog\n\nSee [CHANGELOG.md](./CHANGELOG.md).\n", "bytes": 8102, "sha": "c18f77a91a519090bab7d0e3c217d5796206f660675e175f313c63b0cc187b4d", "repo_slug": "traderouter/trade-router-mcp", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/mcp_io_github_traderouter_trade_router_mcp_6ddd999b/readme" }