VibeTrader MCP Server
A Model Context Protocol (MCP) server that connects AI assistants like Claude Desktop, Cursor, and Windsurf to VibeTrader's trading platform.
Features
- Create Bots: Create AI-powered trading bots using natural language
- Manage Bots: Start, pause, delete, and monitor your bots
- Portfolio: View positions and account balance
- Market Data: Get quotes and the market clock
- Signal Mode: Bots that tell you what to trade at any brokerage, including ones VibeTrader can't trade such as Robinhood, and track the fills you report back
- Backtesting: Test strategies on historical data
Available Tools
37 tools are available over either endpoint below. authenticate exists only over local stdio — hosted clients sign in instead (see Connect).
Endpoints
The hosted server speaks both MCP HTTP transports:
The original https://vibetrader-mcp-289016366682.us-central1.run.app/mcp and
/sse URLs keep working, with sign-in too. Prefer /mcp for anything new: SSE
is deprecated upstream.
Connect
Claude (claude.ai, Desktop, mobile) or ChatGPT: add a custom connector with
https://mcp.vibetrader.markets/mcp and click Connect. You sign in to
VibeTrader and choose what the assistant may do. No key to copy.
Claude Code:
claude mcp add --transport http vibetrader https://mcp.vibetrader.markets/mcp
mcp-remote (for clients that only run local servers) signs in the same way:
{
"mcpServers": {
"vibetrader": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://mcp.vibetrader.markets/mcp"]
}
}
}
Clients that send a key (Cursor, Windsurf, OpenClaw, scripts): create a key at https://vibetrader.markets/settings and send it as a header:
{
"mcpServers": {
"vibetrader": {
"url": "https://mcp.vibetrader.markets/mcp",
"headers": { "Authorization": "Bearer vt_YOUR_KEY" }
}
}
}
Permissions
Every connection — and every key — carries what the user allowed:
The VibeTrader API enforces them on every request. A tool called outside them fails with a message saying how to allow it. Keys can instead have full API access for scripts (everything but account settings). Users disconnect an app in Settings → Connected apps.
A request without a token
Over HTTP every request needs Authorization: Bearer ... — a sign-in token or a
vt_ key. Without one the server answers 401 with a WWW-Authenticate header
pointing at /.well-known/oauth-protected-resource/mcp, which names
https://api.vibetrader.markets as the sign-in server; that is what makes an
assistant show Connect. Pasting a key into chat (the old authenticate step)
is gone over HTTP; it remains for local stdio (python server.py stdio).
Signal mode: trade at any brokerage
place_order and close_position only reach your VibeTrader Alpaca account. For
money anywhere else, put a bot in signal mode. It keeps watching the market and
deciding, but sends you each entry and exit instead of trading:
set_signal_mode(bot_id, follow_account="manual")(pause the bot first)list_open_signals(): what to buy or sell, how much, and near what price- Place the order with that brokerage's own tools. With Robinhood's MCP connected in the same assistant, the assistant can do this step too.
report_signal(bot_id, decision_id, "bought", qty, price)with the real fill, so the bot tracks your actual shares and results and sends the exits.
Signals also arrive by push, email or webhook, set up in the app.
Development
# Install dependencies
pip install -r requirements.txt
# Run locally (HTTP mode — serves both /mcp and /sse on :8080,
# the same app the deployment runs)
python server.py
# ...or exactly as the container does
uvicorn server:app --host 0.0.0.0 --port 8080
# Run in STDIO mode (for a local Claude Desktop install)
python server.py stdio
Then point a client at http://localhost:8080/mcp or http://localhost:8080/sse.
Deployment
Deployed on Google Cloud Run at mcp.vibetrader.markets
gcloud run deploy vibetrader-mcp --source . --region us-central1 --max-instances=1
Keep --max-instances=1: place_order's retry memory lives in the process.
Security
- Every HTTP request needs a sign-in token or a key, read from that request's own
Authorizationheader and stored nowhere — never shared between users - Sign-in is OAuth 2.1 with PKCE against VibeTrader's API; tokens last an hour, refresh tokens rotate, and disconnecting an app ends its access immediately
- What a connection may do is enforced by the API, not just this server
- All requests are made over HTTPS
- Paper trading mode is default for safety
- Every tool declares MCP annotations, so your client can run read-only tools without asking and confirm the ones that trade, start bots or delete
place_ordergives the same order the same order id while retries keep coming within two minutes of the last try, so retrying a call (say, after a timeout) never places a second order. Passidempotency_keyto hold the id for as long as you like