riskstate-mcp
The RiskState MCP server provides a single get_risk_policy tool for real-time risk governance, designed for autonomous crypto trading agents to query before executing trades.
Get risk policy decisions: Receive a structured policy including one of 5 levels —
BLOCK_SURVIVAL,BLOCK_DEFENSIVE,CAUTIOUS,GREEN_SELECTIVE, orGREEN_EXPANSION— along withmax_size_pct,leverage_max, and lists of allowed/blocked actionsSupport BTC and ETH: Currently performs risk analysis for Bitcoin and Ethereum
Assess market conditions: Responses include
cycle_phase,market_regime,macro_regime, anddirectionclassificationsReceive confidence and auditability metrics: Get
confidence_score(0–1),composite_score,policy_hash, andttl_secondsfor cache management and auditabilityIntegrate DeFi on-chain data: Optionally provide a
wallet_addressand lending protocol (sparkoraave) to factor in on-chain position data (LTV, health factor)Request detailed breakdowns: Use
include_detailsto get composite subscores, macro data, risk flags, and data sourcesHandle errors gracefully: Specific error messages for authentication issues, rate limits, and timeouts aid agent recovery
Integrate with Claude ecosystem: Works with Claude Desktop and Claude Code via MCP protocol with stdio transport, with input validation via Zod schemas
RiskState MCP Server
MCP server for RiskState — pre-trade risk permissions for BTC/USD and ETH/USD. Spot, perpetual futures (perps), and DeFi borrowing aware.
Your system asks: "How much can I risk right now?" RiskState answers with: policy level, max exposure, leverage limits, blocked actions — computed from 30+ real-time signals.
Two ways to use RiskState over MCP
1. Remote connector — no install, no API key. RiskState runs a hosted MCP server (Streamable HTTP) with a free public tier:
https://api.riskstate.ai/mcpAdd it as a custom connector in Claude or
ChatGPT, then just ask what the risk
state of BTC is. It exposes three read-only tools — get_risk_state,
get_market_structure, get_playbook_status — covering all three engines, and
is listed on the official MCP registry as ai.riskstate/mcp.
Responses are the free public summary: the same altitude as the public
visualizer. policy_hash, composite subscores, positioning and macro detail
need a key.
2. This package — stdio, keyed, full response. Use it when you want the
complete audited payload in a local agent, or to pin a version in your own
toolchain. It needs a RISKSTATE_API_KEY and returns everything your key is
entitled to. That is what the rest of this README covers.
Related MCP server: zarq-risk-intelligence
Tools
Four read-only tools, one per question you might ask before a trade:
Tool | Answers | Endpoint | Key |
| How much exposure is allowed? |
| yes |
| Are we near a structural inflection? |
| yes |
| Is a setup actionable right now? |
| no |
| Would THIS position be allowed? |
| yes |
get_risk_policy returns:
Field | Description |
| 5 levels: BLOCK_SURVIVAL, BLOCK_DEFENSIVE, CAUTIOUS, GREEN_SELECTIVE, GREEN_EXPANSION |
| Maximum position size as % of portfolio (0-100) |
| Maximum allowed leverage multiplier |
| What the agent CAN do at this policy level |
| What the agent CANNOT do |
| Signal agreement x data quality (0-1) |
check_trade evaluates a hypothetical book — send the position you are
considering plus anything you already hold, since the caps are
portfolio-aware. It returns per position whether it is allowed, the size cap in
percent and dollars, and reason_codes when it is not. Those are blocking;
advisories are informational and do not affect allowed. It places no orders.
get_playbook_status reports a setup as actionable only when its conditions
match, no engine vetoed it, and it is not in alert cooldown. Setups that
match but already alerted are counted separately, so an agent polling this tool
does not act on the same signal twice.
Why there are no write tools
There is no update_policy, no set_limit, no exception management — and there
will not be. The premise of RiskState is that the system being governed cannot
move its own limits. Every decision is hashed (policy_hash) so it can be
audited afterwards against the inputs that produced it; a tool that let the
caller rewrite the policy would make that hash meaningless and the audit trail
decorative.
So the lifecycle here deliberately lives on one side: the engine computes, the
agent reads and complies. check_trade is the closest thing to a dynamic
per-trade operation, and it is still read-only — it answers "would this be
allowed", never "allow this".
The API aggregates 9+ real-time data sources server-side. See API docs for details.
What this wrapper does (and doesn't)
This is a thin wrapper — it translates MCP tool calls into REST API requests and returns the response. All computation (scoring, policy engine, data ingestion) happens server-side.
This wrapper adds:
MCP protocol compliance (stdio transport for Claude Desktop/Code)
Input validation via Zod schemas
Human-readable policy summary prepended to responses
Specific error messages (auth, rate limit, timeout) for agent recovery
This wrapper does NOT:
Cache responses (the API has 60s server-side cache)
Perform any scoring or computation locally
Guarantee response schema stability (follows API versioning)
Installation
npm install @riskstate/mcp-serverConfiguration
Environment Variables
Variable | Required | Description |
| Yes | API key from riskstate.ai (free during beta) |
| No | Custom API base URL (default: |
Claude Desktop
Add to ~/.config/Claude/claude_desktop_config.json:
{
"mcpServers": {
"riskstate": {
"command": "npx",
"args": ["-p", "@riskstate/mcp-server", "riskstate-mcp"],
"env": {
"RISKSTATE_API_KEY": "your-api-key"
}
}
}
}Claude Code
claude mcp add riskstate -- npx -p @riskstate/mcp-server riskstate-mcpSet the API key in your environment:
export RISKSTATE_API_KEY=your-api-keyGlobal install (alternative)
npm install -g @riskstate/mcp-server
riskstate-mcp # starts MCP server on stdioUsage
The four tools are listed above. get_risk_policy takes:
Parameters
Parameter | Type | Required | Description |
|
| Yes | Asset to analyze |
| string | No | DeFi wallet for on-chain position data |
|
| No | Lending protocol (default: spark) |
| boolean | No | Include full breakdown (subscores, macro, risk flags) |
Example Response
{
"exposure_policy": {
"policy_level": "CAUTIOUS",
"max_size_pct": 35,
"leverage_max": 1.5,
"allowed_actions": ["DCA", "WAIT", "SPOT_LONG_CONFIRMED"],
"blocked_actions": ["LEVERAGE_GT_2X", "NEW_POSITIONS_UNCONFIRMED"]
},
"classification": {
"cycle_phase": "MID",
"market_regime": "RANGE",
"macro_regime": "NEUTRAL",
"direction": "SIDEWAYS"
},
"auditability": {
"composite_score": 52,
"confidence_score": 0.72,
"policy_hash": "a3f8c2...",
"ttl_seconds": 60
}
}How Agents Should Use This
Call get_risk_policy before every trade:
If
policy_levelstarts withBLOCK→ do not open new positionsUse
max_size_pctto cap position sizingCheck
blocked_actionsbefore executingRe-query after
ttl_seconds(60s cache)
For a sized position, check_trade collapses steps 2-3 into one call: send the
position you intend to open along with what you already hold, and read allowed
plus reason_codes. Prefer it over re-deriving the cap yourself, since the caps
are portfolio-aware and a position that passes in isolation can still breach
concentration once aggregated.
get_market_structure and get_playbook_status are context, not permission.
Neither one authorises a trade — only the risk policy does. Use them to decide
whether a trade is worth proposing, then get_risk_policy / check_trade to
learn how much of it you are allowed.
Limitations
v1 scope: BTC/USD and ETH/USD only (USD-denominated assessment). More assets planned.
Markets: Spot, perpetual futures, and DeFi borrowing. Same response — interpretation differs by market (see API docs).
Protocols: Spark and Aave V3 only for DeFi position data.
Rate limit: 60 requests/minute per API key.
Latency: ~1-3s per request (9+ upstream data source aggregation).
Tested with: Claude Desktop, Claude Code. Should work with any MCP-compatible client.
Links
Landing page: riskstate.ai
API docs: riskstate.ai/docs/api
SKILL.md: agentskills.io
License
MIT
Available Tools
4 toolscheck_tradeAInspect
Assess one or more PROPOSED positions against the engine's limits before placing them. Returns, per position, whether it is allowed, the policy level, the size cap in percent and dollars, and the reason codes when it is not — plus portfolio-level gross/net exposure and concentration. Read-only: it evaluates a hypothetical book and places no orders. Send the position(s) you are considering, including any you already hold, since the caps are portfolio-aware.
| Name | Required | Description | Default |
|---|---|---|---|
| positions | Yes | The book to assess: proposed position(s) plus anything already held |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full disclosure burden. It explicitly states the tool is read-only, evaluates a hypothetical book, places no orders, and describes the exact outputs returned (per-position allowed check, policy level, size caps in percent and dollars, reason codes, and portfolio-level exposure/concentration). This is exemplary transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences that front-load the core action and intent, then give output context, then read-only and input guidance. Each sentence earns its place; only the comfortable return-value enumeration adds slight length, but it's essential in the absence of an output schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has one nested parameter, no annotations, and no output schema, so the description must carry pre-hybrid and return-value context. It does so thoroughly, covering what the tool checks, what it returns, and the portfolio-aware caveat. Minor absence: formal error behavior or rate limiting, but these are not critical for a read-only check tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3; the description adds real semantic value by clarifying that positions should include already-held items because caps are portfolio-aware, and that returns include size caps in percent and dollars. It doesn't restate the schema enums, but it does deepen an agent's understanding of how to populate the field.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource ('Assess one or more PROPOSED positions against the engine's limits before placing them'), and it clearly differentiates itself from the sibling read tools (get_market_structure, get_playbook_status, get_risk_policy) by describing the hypothetical-book evaluation and the explicit 'Read-only: it places no orders' note.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It says when to call the tool ('before placing them') and how to construct the input ('include any you already hold, since the caps are portfolio-aware'). It doesn't explicitly exclude alternative tools or state when not to use it, like 'if you just want the raw policy, use get_risk_policy', but the intended invocation context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_market_structureAInspect
Get the structural picture for a crypto asset from the Market Structure Engine: where price sits in its cycle and range, which structural events are forming or confirmed, the breakout/breakdown triggers, and the friction zones (price walls) in between. Answers 'are we near an inflection?' — it does NOT say how much you may risk; use get_risk_policy for that.
| Name | Required | Description | Default |
|---|---|---|---|
| asset | Yes | Asset to get the structural read for |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses what the tool provides, what it deliberately does NOT provide (risk amount), and points to the correct sibling. It does not explicitly state read-only behavior or side effects, but 'Get the structural picture' implies a read operation; the explicit non-claim adds useful boundary context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler. The first sentence front-loads the verb and resource then lists concrete output categories; the second delivers the yes/no question the tool answers and the explicit exclusion with a named alternative. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter, read-oriented tool with no output schema, the description is complete: it explains what the return covers, what the tool cannot tell you, and which sibling to use instead. An agent has everything needed to decide whether to call this tool and what to expect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single asset parameter, which already documents valid values (BTC, ETH) and meaning. The description only adds the generic 'crypto asset' context, so baseline 3 is appropriate since the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource ('Get the structural picture for a crypto asset') and enumerates exactly what it returns: cycle/range position, structural events, triggers, and friction zones. It explicitly names the sibling it is not (get_risk_policy), making differentiation immediate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It tells the agent when to use the tool ('Answers are we near an inflection?') and explicitly states when not to: if you need risk sizing, use get_risk_policy instead. This is clear, actionable routing with no inference required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_playbook_statusAInspect
List the locked trading playbooks and which setups are actionable right now, per asset. A setup is actionable only when its conditions match, no engine vetoed it, and it is not in alert cooldown — setups that match but already alerted are reported separately, so you do not act on the same signal twice. This endpoint is public and needs no API key.
| Name | Required | Description | Default |
|---|---|---|---|
| asset | No | Restrict to one asset (default: both) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that setups already alerted are reported separately to prevent duplicate signals, mentions the engine veto and alert cooldown logic, and states it is public. This is substantial behavioral detail beyond the schema, though it omits potential rate limits or response format details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is moderately long but well-structured, front-loading the core purpose and then clarifying the actionable condition. Every sentence adds relevant detail, though it could be slightly tightened. It is not verbose and reads clearly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity (one optional parameter, no output schema), the description explains what is returned (list of playbooks, actionable setups, and separately reported already-alerted setups) and the filtering logic. It lacks explicit error or pagination notes, but for this tool the coverage is sufficient for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single parameter 'asset', which includes an enum and description. The tool description adds minor context by mentioning 'per asset' but does not go beyond what the schema already documents. A baseline of 3 is appropriate when the schema fully explains the parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists locked trading playbooks and actionable setups per asset, with a precise definition of what 'actionable' means. It specifies the resource (playbooks) and verb (list), and distinguishes itself from generic siblings by its focus on actionable conditions, though it does not explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides some usage context by stating the endpoint is public and needs no API key, and it explains the semantics of actionable setups. However, it does not explicitly state when to use this tool versus siblings like get_market_structure or check_trade, nor does it give any exclusions or alternative conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_risk_policyAInspect
Get the current risk governance policy for a crypto asset. Returns policy level (BLOCK/CAUTIOUS/GREEN), max position size, leverage limits, allowed and blocked actions, and confidence score. Call this BEFORE every trade to determine how much risk is allowed.
| Name | Required | Description | Default |
|---|---|---|---|
| asset | Yes | Asset to get risk policy for | |
| protocol | No | DeFi lending protocol (default: spark) | |
| wallet_address | No | DeFi wallet address for on-chain position data (LTV, health factor) | |
| include_details | No | Include detailed breakdown: composite subscores, macro data, risk flags, data sources |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, but description implies a read-only operation ('Get'). Discloses what is returned. Does not hide any destructive behavior. Lacks detail on authentication or rate limits, but adequate for a policy retrieval tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose and output details, followed by usage guideline. No unnecessary words. Excellent conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no output schema or sibling tools, description provides clear purpose, return fields, and usage context. Could mention output format (JSON) but not essential. Sufficient for agent to select and invoke.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for all 4 parameters. Description does not add significant new semantics beyond the schema; it focuses on return values. Baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'Get the current risk governance policy for a crypto asset' with specific verb and resource. Lists returned fields including policy level, position size, leverage limits, etc. Purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Call this BEFORE every trade to determine how much risk is allowed.' Provides clear usage context. No alternative tools or when-not-to-use mentioned, but for a standalone tool, this is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v1.1.0- Added
check_trade - Added
get_market_structure - Added
get_playbook_status
1 tool update
- Changed
get_risk_policy1 field changed- added
Input schema / properties / wallet_address / patternAdded value: +"^0x[a-fA-F0-9]{40}$"
1 tool update
v1.0.0- First observed
get_risk_policy
TDQS
Scored across 4 tools
Each tool has a clearly distinct responsibility: market structure, playbook status, risk policy, and trade validation. The descriptions explicitly cross-reference each other to prevent confusion, such as get_market_structure noting it does not provide risk amounts and directing users to get_risk_policy.
All tool names follow a consistent snake_case verb_noun pattern: get_market_structure, get_playbook_status, get_risk_policy, and check_trade. The use of 'check' instead of 'get' is still an appropriate action verb and does not break the overall predictable pattern.
Four tools is well-scoped for a focused risk-state server. Each tool serves a distinct and necessary function in the pre-trade risk workflow, with no bloat and no sense of a thin toolkit.
The tool set covers the complete pre-trade risk assessment loop: market structure for context, risk policy for limits, playbook status for actionable setups, and check_trade for hypothetical validation. There are no obvious missing operations within the stated domain, and it appropriately avoids scope creep into order execution.
Maintenance
Related MCP Connectors
Treasury and risk controls for agent wallets: policies, quotes, prediction-market orders.
Live crypto market signals for AI agents: perp liquidations, funding, OI positioning, yield, FX.
Risk regime + treasury for AI agents on Base: free regime reads, signed attestations, idle USDC.
Crypto regime classifier for trading agents. 100% bounded regime accuracy. 50 free calls/day.
Related MCP Servers
- AlicenseAqualityNot gradedmaintenanceMCP Server for AsterPay x402 Data API — market data, AI tools, crypto analytics, and utilities accessible to AI agents via Model Context Protocol. 13 pay-per-call endpoints on Base network, $0.001 USDC each. EUR settlement for AI agent commerce.1737-

zarq-risk-intelligenceofficial
AlicenseNot gradedqualityDmaintenanceReal-time crypto risk scoring for AI agents. Trust Score, crash probability, and distance-to-default for 205 tokens. Free, no API key needed.MIT- AlicenseNot gradedqualityCmaintenanceEnables AI agents to analyze Ethereum wallets, simulate transactions, and draft transfers with deterministic policy and risk scoring, requiring human approval before on-chain execution.11ISC
- AlicenseNot gradedqualityBmaintenanceThe verifiable risk engine for autonomous agents: deterministic, self-verifying financial calculations that an agent can delegate and prove. It covers liquidation and funding, position sizing and risk of ruin, options Greeks and margin, LP divergence, treasury concentration and depeg, execution quality checks, plus intelligence on options, DeFi, prediction markets, and transaction safety analysis.51MIT