eToro MCP Server (Security-Hardened Fork)

Originally created by orkblutt — full credit to the original author. This is a security-hardened fork. See SECURITY.md for all changes made. Original repo: https://github.com/orkblutt/etoro-mcp

MCP server that wraps the eToro public API, exposing 34 tools for AI assistants (Claude Desktop, Cursor, Claude Code, etc.).

Security Improvements Over Original

This fork fixes 9 security issues found in the original:

• 🔴 API key headers were swapped (x-api-key ↔ x-user-key)

• 🔴 Usernames injected into URLs without encodeURIComponent

• 🟠 Missing credentials only warned — now hard-fails at startup

• 🟠 No rate limiting — token-bucket limiter added for trading & readonly ops

• 🟠 No content limits on social posting — now capped at 1000/500 chars

• 🟡 Raw eToro API error bodies leaked to LLM — now sanitized

• 🟡 get_closing_prices fetched all instruments — now requires explicit IDs

• 🟡 No live-mode warnings on trading tools — now logs prominently

• 🟡 Missing Zod input validation (min/max/int/positive) across all tools

Full details in SECURITY.md.

Related MCP server: Alpaca MCP Gold Standard

What Can You Do With It?

Below are real conversations with an AI assistant connected to the eToro MCP server.

Place a limit order

You: Place a buy limit order for 5 SOL if it reaches $75

Assistant: Current SOL price is $78.21. I've placed a buy limit order for 5 SOL at $75 ($375 total) with a stop loss at $1. Order confirmed.

DCA ladder based on technical analysis

You: Can you place some DCA buy limit orders for ETH based on key support levels?

Assistant: Based on the chart, here are the key support levels for ETH:

• $1,750 — first support zone

• $1,500 — strong horizontal support

• $1,200 — macro support

• $1,000 — psychological floor

I've placed 4 limit orders across those levels.

Portfolio analysis

You: What's my average entry price on SOL including all my positions?

Assistant: You have 27 SOL positions totaling 124.62 SOL with an average entry of $120.99.

Market research

You: What do you think about SUI?

Assistant: SUI is trading at $0.905, down 75% from its October high of $3.70. Your 4 positions total 3,434 SUI at an average of $1.18 — currently -23%.

Setup

1. Build

npm install
npm run build

2. Configure credentials

You need an eToro API key and user key.

Option A: Environment variables (recommended)

export ETORO_API_KEY=your-api-key
export ETORO_USER_KEY=your-user-key
export ETORO_TRADING_MODE=demo   # use "real" for live trading
node dist/index.js

Option B: Claude Desktop (claude_desktop_config.json)

{
  "mcpServers": {
    "etoro-mcp": {
      "command": "node",
      "args": ["/path/to/etoro-mcp/dist/index.js"],
      "env": {
        "ETORO_API_KEY": "your-api-key",
        "ETORO_USER_KEY": "your-user-key",
        "ETORO_TRADING_MODE": "demo"
      }
    }
  }
}

Option C: CLI arguments

node dist/index.js --api-key your-api-key --user-key your-user-key --trading-mode demo

⚠️ Note: The server will refuse to start if ETORO_API_KEY or ETORO_USER_KEY are missing.

3. Restart the MCP server

After changing config, restart the server or the Claude Desktop app.

Configuration

Trading mode: demo routes trading calls through eToro's demo/virtual account. Set to real for live trading. A prominent warning is logged when live mode is active.

Rate Limiting

This fork adds a token-bucket rate limiter to protect your account from unintended burst activity in agentic loops:

Tools (34 total)

Market Data (8)

Trading (7)

Social Feeds (4)

Watchlists (9)

User & Discovery (6)

Credits

• Original author: orkblutt — https://github.com/orkblutt/etoro-mcp

• Security audit & fixes: Vipul Ranjan

• License: MIT (see LICENSE)