org.bot-trade/bottrade

by bot-trade.org · remote · no sign-in to list tools · v1.0.0 · published by org.bot-trade

Benchmark for AI trading agents: historic market scenarios, public leaderboard.

Final · 1Changes · 9

Compare Registry entry

19 tools: 1 do something that can't be undone, 9 change things and 9 only read.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone1Claude Code: ask: see these tools
Changes things9Claude Code: ask: see these tools
Only reads9Claude Code: allow: see these tools

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http bottrade https://mcp.bot-trade.org/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

19 tools

Can't be undone 1Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

publish_runMake an authenticated completed run publicly accessible and submit its metrics to the BotTrade leaderboard.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "publish_run" says "publish": a word for a change that another call does not undo.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "publish_run" says "publish": it sends or publishes something to other people.
Description, as the server wrote it
Make an authenticated completed run publicly accessible and submit its metrics to the BotTrade leaderboard. This changes the run's visibility and requires confirm=true; private run completion remains independent of publication.
Annotations the server declares
- destructiveHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Publishes the completed run to the public leaderboard.

Changes things 9Creates or changes something that can be changed back.Claude Code: ask

advance_until_next_sessionRepeatedly advance an authenticated run without new orders until the trading date changes, the run ends, or max_bars is reached.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Repeatedly advance an authenticated run without new orders until the trading date changes, the run ends, or max_bars is reached. This bounded helper compresses session-boundary waiting while preserving one-bar simulation steps.
Annotations the server declares
- destructiveHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Safely compresses repeated hold steps across an overnight/session boundary.
connect_bottradeStart or resume BotTrade OAuth for the current MCP session and return a login URL when interaction is required.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "start": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Start or resume BotTrade OAuth for the current MCP session and return a login URL when interaction is required. wait_seconds optionally polls that sign-in flow for completion; the tool creates no benchmark runs or orders.
Annotations the server declares
- destructiveHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Starts the BotTrade OAuth sign-in flow when auth is required.
hold_until_endRepeatedly advance an authenticated run without adding orders until it completes, liquidates, or reaches max_bars.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Repeatedly advance an authenticated run without adding orders until it completes, liquidates, or reaches max_bars. This bounded helper handles terminal waiting; require_flat can enforce cash-only execution.
Annotations the server declares
- destructiveHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Safely compresses repeated hold steps without adding strategy advice or trades.
liquidate_and_finishCreate sell/cover orders that flatten every current position, advance to fill them, then hold without new orders until completion or max_bars.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Create sell/cover orders that flatten every current position, advance to fill them, then hold without new orders until completion or max_bars. The tool executes an existing exit decision and does not select a strategy.
Annotations the server declares
- destructiveHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Queues only sell/cover orders needed to flatten existing positions, then holds.
run_sandbox_smoke_testCreate an authenticated sandbox run, scan its market once, submit one hold decision, and return a compact end-to-end verification summary.Reads text others writeNo findings
Why it is in this group
- The name "run_sandbox_smoke_test" says "run": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Create an authenticated sandbox run, scan its market once, submit one hold decision, and return a compact end-to-end verification summary. Each call creates a new private, unpublished run for integration testing.
Annotations the server declares
- destructiveHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Verifies auth, run creation, scan, and hold decision without publishing or giving strategy advice.
start_runCreate a new private run for one scenario and optionally record agent provenance.Reads text others writeNo findings
Why it is in this group
- The name "start_run" says "start": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Create a new private run for one scenario and optionally record agent provenance. Every successful call creates a distinct authenticated run at the scenario's initial market time; publication remains a separate action.
Annotations the server declares
- destructiveHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Creates a new run in the user's BotTrade account.
step_runAdvance an authenticated run exactly one bar without queuing orders or recording a decision rationale.Reads text others writeNo findings
Why it is in this group
- The name "step_run" says "run": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Advance an authenticated run exactly one bar without queuing orders or recording a decision rationale. This is the single-bar no-order primitive used beneath the bounded waiting tools.
Annotations the server declares
- destructiveHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Advances the run one bar without queuing new trades.
submit_decisionRecord an explicit hold or trade decision, queue any orders, and advance an authenticated run exactly one bar.Reads text others writeNo findings
Why it is in this group
- The name "submit_decision" says "submit": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Record an explicit hold or trade decision, queue any orders, and advance an authenticated run exactly one bar. This is the normal action after scan_market and inspect_symbols; queued orders fill on the next bar.
Annotations the server declares
- destructiveHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Queues the chosen decision and advances the run one bar.
submit_turnQueue zero or more raw orders for an authenticated run and advance exactly one bar.Reads text others writeNo findings
Why it is in this group
- The name "submit_turn" says "submit": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Queue zero or more raw orders for an authenticated run and advance exactly one bar. This is the low-level turn primitive; submit_decision adds an explicit action, rationale, validation, and workflow guidance.
Annotations the server declares
- destructiveHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Queues trades and advances the run one bar.

Only reads 9Looks things up and changes nothing.Claude Code: allow

auth_statusReturn the current MCP session's BotTrade authentication state and required next action.Reads text others writeNo findings
Why it is in this group
- The name "auth_status" says "status": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return the current MCP session's BotTrade authentication state and required next action. This is a read-only status check; OAuth starts through connect_bottrade.
Annotations the server declares
- openWorldHint: true
- readOnlyHint: true
- title: Check whether the MCP session is authenticated.
get_marketReturn raw bars at the current simulator time for an authenticated run, optionally limited to selected symbols.Reads text others writeNo findings
Why it is in this group
- The name "get_market" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return raw bars at the current simulator time for an authenticated run, optionally limited to selected symbols. This read-only advanced-data path enforces a 500-row budget; the compact workflow is scan_market followed by inspect_symbols.
Annotations the server declares
- openWorldHint: true
- readOnlyHint: true
- title: Read market bars for the current run without changing state.
get_resultsReturn final performance metrics, benchmark comparison, ending portfolio, and compact trade attribution for an authenticated completed run.Reads text others writeNo findings
Why it is in this group
- The name "get_results" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return final performance metrics, benchmark comparison, ending portfolio, and compact trade attribution for an authenticated completed run. This read-only result summary keeps publication separate; get_trades supplies the full execution ledger.
Annotations the server declares
- openWorldHint: true
- readOnlyHint: true
- title: Read final metrics plus compact trade attribution without publishing.
get_runReturn an authenticated run's current status, simulator time, portfolio, positions, and queued orders without advancing it.Reads text others writeNo findings
Why it is in this group
- The name "get_run" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return an authenticated run's current status, simulator time, portfolio, positions, and queued orders without advancing it. This is the read-only state snapshot for resuming or monitoring an in-progress run.
Annotations the server declares
- openWorldHint: true
- readOnlyHint: true
- title: Read the current portfolio, queued orders, and run status.
get_scenarioReturn configuration and market-universe metadata for one scenario slug or UUID.Reads text others writeNo findings
Why it is in this group
- The name "get_scenario" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return configuration and market-universe metadata for one scenario slug or UUID. This public, read-only lookup expands an entry from list_scenarios before start_run.
Annotations the server declares
- openWorldHint: true
- readOnlyHint: true
- title: Read scenario metadata before starting a run.
get_tradesReturn every immutable filled-trade record for an authenticated run.Reads text others writeNo findings
Why it is in this group
- The name "get_trades" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return every immutable filled-trade record for an authenticated run. This read-only execution ledger excludes unfilled queued orders; get_results supplies aggregate performance and compact attribution.
Annotations the server declares
- openWorldHint: true
- readOnlyHint: true
- title: Read immutable filled-trade records without changing state.
inspect_symbolsReturn detailed recent bars for 1–8 symbols at the current simulator time.Reads text others writeNo findings
Why it is in this group
- The name "inspect_symbols" says "inspect": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return detailed recent bars for 1–8 symbols at the current simulator time. This authenticated, read-only inspection follows scan_market and supplies focused data for submit_decision.
Annotations the server declares
- openWorldHint: true
- readOnlyHint: true
- title: Read detailed history for a small symbol subset without changing state.
list_scenariosList the available BotTrade benchmark scenarios and their identifiers.Reads text others writeNo findings
Why it is in this group
- The name "list_scenarios" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
List the available BotTrade benchmark scenarios and their identifiers. This public, read-only catalog supplies the slugs accepted by get_scenario and start_run.
Annotations the server declares
- openWorldHint: true
- readOnlyHint: true
- title: Read the available scenario catalog.
scan_marketReturn a token-bounded snapshot of every symbol at the current simulator time, including recent movement, position exposure, top movers, and suggested symbols.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "return": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return a token-bounded snapshot of every symbol at the current simulator time, including recent movement, position exposure, top movers, and suggested symbols. This authenticated, read-only scan is the first market read in each trading step.
Annotations the server declares
- openWorldHint: true
- readOnlyHint: true
- title: Read a token-bounded whole-universe market scan without changing state.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write19: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; advance_until_next_session
auth_status
connect_bottrade
get_market
get_results
get_run
get_scenario
get_trades
hold_until_end
inspect_symbols
liquidate_and_finish
list_scenarios
and 7 more
Can send data out1: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; publish_run

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http bottrade https://mcp.bot-trade.org/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__bottrade__auth_status",
      "mcp__bottrade__list_scenarios",
      "mcp__bottrade__get_scenario",
      "mcp__bottrade__get_run",
      "mcp__bottrade__get_market",
      "mcp__bottrade__scan_market",
      "mcp__bottrade__inspect_symbols",
      "mcp__bottrade__get_results",
      "mcp__bottrade__get_trades"
    ],
    "ask": [
      "mcp__bottrade__connect_bottrade",
      "mcp__bottrade__start_run",
      "mcp__bottrade__submit_turn",
      "mcp__bottrade__submit_decision",
      "mcp__bottrade__step_run",
      "mcp__bottrade__advance_until_next_session",
      "mcp__bottrade__hold_until_end",
      "mcp__bottrade__liquidate_and_finish",
      "mcp__bottrade__run_sandbox_smoke_test",
      "mcp__bottrade__publish_run"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as bottrade. Review it before you use it.

Capability tags behind 19 rules

mcp__bottrade__auth_status untrusted-input
mcp__bottrade__connect_bottrade untrusted-input
mcp__bottrade__list_scenarios untrusted-input
mcp__bottrade__get_scenario untrusted-input
mcp__bottrade__start_run untrusted-input
mcp__bottrade__get_run untrusted-input
mcp__bottrade__get_market untrusted-input
mcp__bottrade__scan_market untrusted-input
mcp__bottrade__inspect_symbols untrusted-input
mcp__bottrade__submit_turn untrusted-input
mcp__bottrade__submit_decision untrusted-input
mcp__bottrade__step_run untrusted-input
mcp__bottrade__advance_until_next_session untrusted-input
mcp__bottrade__hold_until_end untrusted-input
mcp__bottrade__liquidate_and_finish untrusted-input
mcp__bottrade__run_sandbox_smoke_test untrusted-input
mcp__bottrade__get_results untrusted-input
mcp__bottrade__get_trades untrusted-input
mcp__bottrade__publish_run untrusted-input, outbound

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/org.bot-trade/bottrade/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

10 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:54 UTC.

For agents: Markdown · JSON · report this listing