VibeTrader MCP Server

A Model Context Protocol (MCP) server that connects AI assistants like Claude Desktop, Cursor, and Windsurf to VibeTrader's trading platform.

Features

• Create Bots: Create AI-powered trading bots using natural language

• Manage Bots: Start, pause, delete, and monitor your bots

• Portfolio: View positions and account balance

• Market Data: Get quotes and the market clock

• Signal Mode: Bots that tell you what to trade at any brokerage, including ones VibeTrader can't trade such as Robinhood, and track the fills you report back

• Backtesting: Test strategies on historical data

Related MCP server: Alpaca MCP Server

Available Tools

37 tools are available over either endpoint below. authenticate exists only over local stdio — hosted clients sign in instead (see Connect).

Endpoints

The hosted server speaks both MCP HTTP transports:

The original https://vibetrader-mcp-289016366682.us-central1.run.app/mcp and /sse URLs keep working, with sign-in too. Prefer /mcp for anything new: SSE is deprecated upstream.

Connect

Claude (claude.ai, Desktop, mobile) or ChatGPT: add a custom connector with https://mcp.vibetrader.markets/mcp and click Connect. You sign in to VibeTrader and choose what the assistant may do. No key to copy.

Claude Code:

claude mcp add --transport http vibetrader https://mcp.vibetrader.markets/mcp

mcp-remote (for clients that only run local servers) signs in the same way:

{
  "mcpServers": {
    "vibetrader": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.vibetrader.markets/mcp"]
    }
  }
}

Clients that send a key (Cursor, Windsurf, OpenClaw, scripts): create a key at https://vibetrader.markets/settings and send it as a header:

{
  "mcpServers": {
    "vibetrader": {
      "url": "https://mcp.vibetrader.markets/mcp",
      "headers": { "Authorization": "Bearer vt_YOUR_KEY" }
    }
  }
}

Permissions

Every connection — and every key — carries what the user allowed:

The VibeTrader API enforces them on every request. A tool called outside them fails with a message saying how to allow it. Keys can instead have full API access for scripts (everything but account settings). Users disconnect an app in Settings → Connected apps.

A request without a token

Over HTTP every request needs Authorization: Bearer ... — a sign-in token or a vt_ key. Without one the server answers 401 with a WWW-Authenticate header pointing at /.well-known/oauth-protected-resource/mcp, which names https://api.vibetrader.markets as the sign-in server; that is what makes an assistant show Connect. Pasting a key into chat (the old authenticate step) is gone over HTTP; it remains for local stdio (python server.py stdio).

Signal mode: trade at any brokerage

place_order and close_position only reach your VibeTrader Alpaca account. For money anywhere else, put a bot in signal mode. It keeps watching the market and deciding, but sends you each entry and exit instead of trading:

1. set_signal_mode(bot_id, follow_account="manual") (pause the bot first)

2. list_open_signals(): what to buy or sell, how much, and near what price

3. Place the order with that brokerage's own tools. With Robinhood's MCP connected in the same assistant, the assistant can do this step too.

4. report_signal(bot_id, decision_id, "bought", qty, price) with the real fill, so the bot tracks your actual shares and results and sends the exits.

Signals also arrive by push, email or webhook, set up in the app.

Development

# Install dependencies
pip install -r requirements.txt

# Run locally (HTTP mode — serves both /mcp and /sse on :8080,
# the same app the deployment runs)
python server.py

# ...or exactly as the container does
uvicorn server:app --host 0.0.0.0 --port 8080

# Run in STDIO mode (for a local Claude Desktop install)
python server.py stdio

Then point a client at http://localhost:8080/mcp or http://localhost:8080/sse.

Deployment

Deployed on Google Cloud Run at mcp.vibetrader.markets

gcloud run deploy vibetrader-mcp --source . --region us-central1 --max-instances=1

Keep --max-instances=1: place_order's retry memory lives in the process.

Security

• Every HTTP request needs a sign-in token or a key, read from that request's own Authorization header and stored nowhere — never shared between users

• Sign-in is OAuth 2.1 with PKCE against VibeTrader's API; tokens last an hour, refresh tokens rotate, and disconnecting an app ends its access immediately

• What a connection may do is enforced by the API, not just this server

• All requests are made over HTTPS

• Paper trading mode is default for safety

• Every tool declares MCP annotations, so your client can run read-only tools without asking and confirm the ones that trade, start bots or delete

• place_order gives the same order the same order id while retries keep coming within two minutes of the last try, so retrying a call (say, after a timeout) never places a second order. Pass idempotency_key to hold the id for as long as you like