@luxalgo/broker-mcp

Give your AI agent read access to your real brokerage accounts — with keys that never leave your machine.

A local MCP server wrapping @luxalgo/broker-sdk. Connect Claude (or any MCP client) to Alpaca, Binance, Kraken, Bybit, Hyperliquid, Interactive Brokers and more, then just ask:

"How's my portfolio doing?" · "What's my win rate this month?" · "What did I trade last week?"

No hosted service, no telemetry, no per-connection fees. The server runs on your machine, your keys live in your own MCP config, and the underlying SDK has no trading endpoints at all — the agent can look, not touch.

Setup

Add the server to your MCP client config with the credential env vars for the brokers you use. Claude Desktop (claude_desktop_config.json) or Claude Code (.mcp.json):

{
  "mcpServers": {
    "brokers": {
      "command": "npx",
      "args": ["-y", "@luxalgo/broker-mcp"],
      "env": {
        "BROKERS_ALPACA_API_KEY": "…",
        "BROKERS_ALPACA_API_SECRET": "…",
        "BROKERS_KRAKEN_API_KEY": "…",
        "BROKERS_KRAKEN_API_SECRET": "…",
        "BROKERS_HYPERLIQUID_WALLET_ADDRESS": "0x…"
      }
    }
  }
}

Every broker whose variables are all set is connected automatically. Create every key with read-only scope — that is all this server ever needs; the list_brokers tool includes the one-line read-only setup guide per broker.

Environment variables

Names derive mechanically from each broker's credential fields: BROKERS_<BROKER>_<FIELD>.

Questrade caveat: its refresh tokens are single-use and rotate on every fetch. The server keeps the rotated token in memory while it runs, but after a restart the token in your config is already consumed — you'll need to paste a fresh one. Static env config and rotating tokens are a poor fit; a better answer is on the roadmap.

Related MCP server: @y0exchange/mcp

Tools

Snapshots are cached in memory for 5 minutes; per-broker failures are reported alongside results, never silently dropped.

Security posture

• Read-only by construction. The SDK underneath implements no order, transfer, or withdrawal endpoint for any broker.

• Keys stay in your MCP config. The server reads them from its environment, reports only whether each variable is set, and never writes secrets anywhere.

• Local only. Talks to your brokers directly over HTTPS and to your MCP client over stdio. No LuxAlgo server involved, no telemetry.

• Still: scope every key read-only at the broker, and treat your MCP config file like the secret store it is.

Development

pnpm install && pnpm check && pnpm build

The SDK dependency installs from the public npm registry like any other package.

Disclaimer

This software reports what your broker reports. It is not investment advice. Verify important numbers against your broker's own statements.

License

MIT © LuxAlgo