Server data from the Official MCP Registry
Paper-trade crypto spot, futures, and prediction markets on CoinRithm with a user API key.
Paper-trade crypto spot, futures, and prediction markets on CoinRithm with a user API key.
Remote endpoints: streamable-http: https://mcp.coinrithm.com/mcp
The CoinRithm MCP trading server demonstrates good security practices with proper scope-based access control, no hardcoded credentials, and secure token handling via environment variables. The code is clean, well-documented, and auth is correctly implemented for both single-user (stdio) and multi-user (HTTP) deployments. Minor code quality observations do not materially impact security. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 2 high severity). Package verification found 1 issue.
5 files analyzed · 7 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Set these up before or after installing:
Environment variable: COINRITHM_API_KEY
Environment variable: COINRITHM_API_URL
Available as Local & Remote
This plugin can run on your machine or connect to a hosted endpoint. during install.
From the project's GitHub README.
Let any AI agent — Claude (Code / Desktop), ChatGPT / Codex, Gemini — paper-trade on CoinRithm using a key you mint and control. Crypto spot, futures, and prediction markets, all on the same 50,000 virtual-mUSD paper account.
🧪 Paper trading only — not financial advice
Every order placed through this surface moves virtual funds (50,000 mUSD, cash coin
USDT). Nothing here touches real money, a real exchange, or a real brokerage. Positions, PnL, and balances are simulated. This is not financial advice and not an offer to trade real assets. An agent acting on your key trades your paper account only.
You stay in control the whole way: mint a key, start read-only, connect, watch it read, then let it trade, and revoke whenever you want.
CoinRithm → Profile → API Keys → Generate. Give it a label (e.g.
claude-desktop). The key looks like crk_live_AbC…_1a2b3c and is shown
once — copy it now. Lose it and you simply revoke and mint a new one.
Pick the least you need. For your first connection, choose read only.
A key's scopes are fixed when you create it, so when you want trading you mint a
separate key with trade scopes (you can't add scopes to an existing key).
read — portfolio, wallet, positions, quotes. Start here.trade:spot / trade:futures / trade:pm — add only when you actually want
the agent placing orders.Primary path — hosted MCP (nothing to install). Paste one URL into your MCP client and add your key as a header:
URL: https://mcp.coinrithm.com/mcp
Header: Authorization: Bearer crk_live_your_key
That's it — the hosted server forwards your key to CoinRithm on every request. Works with any MCP client that supports a remote (Streamable HTTP) server.
Secondary path — local server (Claude Desktop / Cursor / Codex). Prefer to run it on your own machine? Use the npm/stdio server:
npx -y @coinrithm/mcp-trading
…with COINRITHM_API_KEY=crk_live_your_key in the MCP config. See
QUICKSTART.md for the exact per-client config, and
examples/ for drop-in files. (For ChatGPT/Codex Actions and
Gemini, import openapi.yaml and set Bearer auth — also in the
Quickstart.)
Before any trading, prove the connection is safe. Ask your agent:
"Call whoami on CoinRithm, then get my portfolio."
whoami echoes back your userId, keyId, and the key's scopes — confirm it
shows only the scopes you granted. With a read-only key, that's all it can do:
read. Nothing it can call moves funds.
Comfortable with what it reads? Now grant trade. Mint a new key with
trade:spot (and/or trade:futures / trade:pm) — scopes are set at creation,
so granting trade always means a fresh key, not editing the old one. Re-point
your agent at the new key (and revoke the old read-only one if you like). A good
agent quotes first, then asks you before placing anything:
"Get a futures quote for BTC long, 5x, 100 mUSD margin. Show me the numbers and ask me before opening."
Profile → API Keys → Revoke. The key stops working on the next request. One key per agent keeps this surgical — kill one integration without touching the rest.
CoinRithm exposes a small, stable agent surface under /api/agent/*. You
authenticate it with a personal API key (format crk_live_…) that you generate
in your CoinRithm profile. The agent presents the key as a Bearer token; scope
gates decide what it may do.
This repo gives you everything to wire that up:
| Path | What it is |
|---|---|
QUICKSTART.md | Per-client setup for the hosted URL and the local server |
openapi.yaml | OpenAPI 3.1 spec — source of truth for ChatGPT Actions & Gemini |
packages/mcp-trading/ | The MCP server: hosted (HTTP, multi-user) and local (stdio) |
skills/coinrithm-trader/ | A Claude Skill with a trading playbook + hard risk rules |
prompts/ | Per-client system prompts |
examples/ | Drop-in config for Claude Desktop, Claude Code, ChatGPT, Gemini |
| Hosted MCP (primary) | Local server (secondary) | |
|---|---|---|
| Connect by | Pasting https://mcp.coinrithm.com/mcp + a Bearer header | npx -y @coinrithm/mcp-trading (stdio) |
| Install | Nothing | Node on your machine |
| Key lives | In your MCP client config, sent per request | In your local env (COINRITHM_API_KEY) |
| Best for | Any remote-MCP-capable client; quickest start | Claude Desktop / Cursor / Codex; keeping the key on your box |
Both forward the same crk_live_… key to https://api.coinrithm.com/api/agent/*
and obey the same scopes.
A key carries one or more scopes. Least privilege is the default (read only).
| Scope | Grants | Endpoints gated |
|---|---|---|
read | Read identity, portfolio, wallet, orders, positions; price quotes | GET /me, /portfolio, /wallet, /orders/open, /positions/*, POST /futures/quote, /pm/quote |
trade:spot | Place / cancel spot orders | POST /spot/order, /spot/order/:id/cancel |
trade:futures | Open / close mock futures | POST /futures/open, /futures/close |
trade:pm | Open mock prediction-market positions | POST /pm/open |
GET /api/agent/me always works on any valid key (it just reports identity +
scopes). A key missing the required scope gets 403.
Note: all mock venues are live —
POST /futures/open,POST /pm/open, spot orders, quotes, reads, and futures-close all work with a correctly-scoped key. (The open endpoints are server-flag-gated and would return403 "… not enabled"only if CoinRithm later disables them.)
Present the key on every /api/agent/* request, either way:
Authorization: Bearer crk_live_xxxxxxxx_abc123
or
X-API-Key: crk_live_xxxxxxxx_abc123
Base URL: https://api.coinrithm.com (live). Hosted MCP: https://mcp.coinrithm.com/mcp.
sha256(key). The
raw crk_live_… value is shown to you exactly once at creation and is
never retrievable again. If you lose it, revoke and mint a new one.crk_live_ prefix lets secret scanners (GitHub etc.)
flag accidental leaks.read-only key for dashboards; only add
trade:* scopes when the agent actually needs to place orders.POST /api/settings/api-keys/:id/revoke. Revocation takes effect on the next
request. Keep keys short-lived; rotate regularly.lastUsedAt) clean.You decide what an agent can do, you can see what it did, and you can stop it at any time.
read-only key and only grant trade:* to one you
actually want placing orders. Hard limits (max leverage 20×, $10 PM minimum,
never exceeding your available balance) are enforced server-side regardless of
what the agent asks for.lastUsedAt, so a rogue or idle integration is
easy to spot.mcp.coinrithm.com forwards your key only to CoinRithm's own
/api/agent/* and stores nothing; if you'd rather the key never leave your
machine, use the local stdio server instead.AI agents make mistakes. They misread instructions, act on stale data, and loop. You are responsible for reviewing what your agent does. These are paper funds — the blast radius is your simulated portfolio and XP — but build the habit now. Nothing here is financial advice.
You ──mint──▶ crk_live_… key (scopes)
│
┌────────────────┼─────────────────┐
▼ ▼ ▼
Claude (MCP) ChatGPT Action Gemini tool
│ │ │
└──── Authorization: Bearer crk_live_… ────┐
▼
hosted: https://mcp.coinrithm.com/mcp (forwards YOUR key)
or local: npx @coinrithm/mcp-trading (stdio, env key)
▼
https://api.coinrithm.com/api/agent/*
(resolves key → your user, scope-gated)
▼
your 50,000 mUSD paper account
See QUICKSTART.md to get going, or the per-client files in
examples/.
Be the first to review this server!
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
by mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
by Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption