BitCLI

io.github.BitCLI-io/bitcli-mcp-serverBitCLI-iostreamable-httpv1.0.0Scanned 1 hour ago

Real-time crypto futures order flow, BCT-30 matrices, and HFT alerts across 1,650+ contracts.

6 tools: 1 do something that can't be undone and 5 change things.

Reads private data · 0
Reads text others write · 0
Can send data out · 1
No findings

Anlyon alternative

6 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

6 tools

Can't be undone 1Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

send_notificationBEHAVIOR: Outbound messaging operation.Can send data outNo findings
Why it is in this group
- The name "send_notification" says "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- outboundThe name "send_notification" says "send": it sends or publishes something to other people.
Description, as the server wrote it
BEHAVIOR: Outbound messaging operation. Routes proactive notifications to the human trader's verified Telegram chat, channel, or Discord webhook. Dispatches discretionary trade ideas, market condition updates, or risk reports to keep the user informed without waiting for prompts. PRICING: $0.001 USD per dispatch. Deducted from daily tariff quota or USD balance. PARAMETER INTERACTIONS: - 'target': Destination identifier string obtained from `user_account.list_destinations`. Prefixes determine transport: 'tg_user:' / 'tg_channel:' for Telegram, 'out_wh:' for Discord webhooks. Must belong to the authenticated account. - 'message': Main message body. For Telegram, supports HTML tags. For Discord, maps to the embed description. - 'title': Optional subject line. For Discord, renders as the embed headline. For Telegram, prepends as a bold header if provided. RETURNS: Structured JSON confirming transmission: 'status' ('dispatched'), 'target', 'message_length', 'timestamp_utc', and '_usage' (cost_usd and remaining quota/balance). USAGE GUIDELINES: Call `user_account` with action='list_destinations' prior to sending to retrieve valid target strings. Use this tool exclusively for informative messaging and human-in-the-loop updates. Do NOT use this tool to monitor market prices or set execution triggers (use `alert_manager` instead). ERRORS: Unauthenticated calls, unverified/foreign destinations, empty messages, or exhausted quotas return an explicit 'isError: true' payload.

Changes things 5Creates or changes something that can be changed back.Claude Code: ask

alert_managerBEHAVIOR: State-mutating operation.No findings
Why it is in this group
- The input takes a statement or command to run (input.command), which can change anything it can reach.
Description, as the server wrote it
BEHAVIOR: State-mutating operation. Injects or removes in-memory execution triggers in the C++ engine. When triggered, it dispatches asynchronous out-of-band notifications (Telegram/Discord) without requiring the agent to remain awake. PRICING: Targeted coin alerts cost $0.001 USD. Global wildcard scans ('*') cost $0.002 USD. Wildcards require a positive USD balance on Free/Trader plans. ACTIONS & PARAMETER INTERACTIONS: - 'create': Deploys a new trigger. Requires 'command'. Returns the assigned alert_id and expiration time. - 'list': Returns an array of currently active triggers, their IDs, and remaining TTLs. Ignores 'command' and 'alert_id'. - 'cancel': Removes a specific trigger. Requires 'alert_id'. Ignores 'command'. - 'clear_all': Purges all active triggers for the account. Ignores 'command' and 'alert_id'. USAGE GUIDELINES: Use this tool to establish asynchronous monitoring instead of polling `market_data`. Requires an authenticated API key; anonymous guests will receive an authorization error. Enforces plan capacity limits. ERRORS: Authentication failures, capacity limit breaches, or syntax errors return an explicit 'isError: true' payload detailing the rejection reason.
calc_engineBEHAVIOR: Deterministic mathematical calculation.No findings
Why it is in this group
- The input takes a statement or command to run (input.command), which can change anything it can reach.
Description, as the server wrote it
BEHAVIOR: Deterministic mathematical calculation. Evaluates crypto futures risk management models using live exchange parameters. PRICING: $0.001 USD per execution. Deducted from daily tariff quota or USD balance. SYNTAX EXAMPLES (Passed in 'command'): - '/pos btc 65k 63.7k 50' (Position Sizing) - '/liq sol 20x short' (True Liquidation with MMR) - '/dca btc 65k:100 64k:200' (DCA Break-Even with exit fees) - '/rr btc 65k 64k 67k 69k' (Multi-Target R:R) - '/fncost btc 10000 long' (Carry Cost) - '/atr btc 1h 2' (Volatility Stops) RETURNS: Output is a structured JSON payload. Depending on the command, keys include: 'ideal_lot_coins', 'notional_usd', 'required_margin', 'liquidation_price', 'true_breakeven_price', 'effective_rr_ratio', or 'stop_distance'. USAGE GUIDELINES: Use this tool exclusively for mathematical risk modeling and lot sizing. For live market scanning, use `market_data`. For setting execution triggers, use `alert_manager`. After calculating risk parameters, it is highly recommended to route the generated stop-loss or liquidation prices into `alert_manager` to automate monitoring. ERRORS: Malformed syntax returns an 'error' JSON key with correction guidance.
market_dataBEHAVIOR: Read-only analytical gateway.No findings
Why it is in this group
- The input takes a statement or command to run (input.command), which can change anything it can reach.
Description, as the server wrote it
BEHAVIOR: Read-only analytical gateway. Fetches real-time derivatives intelligence across Binance, Bybit, and Hyperliquid. PRICING: $0.001 USD per execution. Deducted from daily tariff quota or USD balance. ACTIONS & RETURNS: - 'screener': Scans 1,650+ perpetuals. Returns a JSON array of matched assets containing fields: symbol, price, rvol, fund, oi, oichg, rsi, bias, natr, cvd. - 'consensus': Returns JSON with Quant TA consensus score, CVD slope, RSI, ATR, and EMA bias for a single coin. - 'bct_matrix': Returns compact historical candlestick matrices with server-side computed indicators to minimize token usage. USAGE GUIDELINES: Use this to analyze market state or find trade setups. Do NOT use this tool to continuously poll for price updates or wait for conditions to be met; instead, invoke `alert_manager` to establish asynchronous monitoring. ERRORS: Malformed filters or unlisted tickers return an explicit JSON error object with syntax correction guidance.
system_docsBEHAVIOR: Read-only RAG documentation tool.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
BEHAVIOR: Read-only RAG documentation tool. Reads and returns official BitCLI markdown specifications, indicator formulas, CLI command guides, and webhook setups. Returns a single string containing the requested Markdown document. PRICING: Free ($0.000). Does not consume quotas. USAGE GUIDELINES: Use this tool FIRST to understand BitCLI mechanics, verify command grammar, or check webhook templates before constructing queries. Do NOT use this tool to query live market prices or active triggers (use `market_data` or `alert_manager` instead). TOPICS: - 'syntax': Price targets, percentage corridors, velocity moves. - 'calculators': Position sizing, true MMR liquidation, DCA break-even, multi-target R:R. - 'market_intel': Screener filters, cross-exchange aggregation. - 'indicators': CVD divergence, Z-Scores, 8h normalized funding. - 'webhooks': PineScript relay setup, private chat routing. - 'tariffs': Subscription tiers and limits. - 'partners': Affiliate program rules. - 'ai': AI Copilot features. - 'mcp': Model Context Protocol architecture. - 'index': System overview. ERRORS: Requesting an invalid topic returns a structured JSON error indicating the file was not found.
user_accountBEHAVIOR: Read-only configuration query.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
BEHAVIOR: Read-only configuration query. Inspects user ledger states, subscription tiers, and verified notification endpoints. PRICING: Free ($0.000). Does not consume daily quotas or balance. ACTIONS: - 'get_billing': Returns subscription tier, available daily USD API quota, remaining USD balance, active alert count, and per-key daily spending safety limits. - 'list_destinations': Returns verified external dispatch targets (Telegram chat IDs, Discord Webhooks) that can be supplied to the `alert_manager`. USAGE GUIDELINES: Use this tool at the beginning of a workflow to understand available budget and determine valid delivery destinations. Do NOT use this tool to manage triggers (use `alert_manager`) or query market data (use `market_data`). ERRORS: Unauthenticated requests lacking a valid API key return an HTTP 401 equivalent error with a registration portal link.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or untrusted-input.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write0: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; send_notification

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http bitcli https://mcp.bitcli.io/mcp

claude mcp add --transport http bitcli https://mcp.bitcli.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__bitcli__system_docs",
      "mcp__bitcli__market_data",
      "mcp__bitcli__calc_engine",
      "mcp__bitcli__alert_manager",
      "mcp__bitcli__user_account",
      "mcp__bitcli__send_notification"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as bitcli. Review it before you use it.

Capability tags behind 1 rule

mcp__bitcli__send_notification outbound

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.BitCLI-io/bitcli-mcp-server/verify?hash=068b6a54810a19fdff522da0fe0ccf70ee6b38edf566255fd2dc2353ec02b1e1" | jq -e '.changed == false'

Pinned hash 068b6a54810a, from Oct 30, 2026, 08:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.BitCLI-io/bitcli-mcp-server/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/io.github.BitCLI-io/bitcli-mcp-server.svg)](https://anlyon.dev/servers/io.github.BitCLI-io/bitcli-mcp-server)

Source: MCP Registry · repository. Synced Oct 30, 2026, 08:17 UTC.