xRocket Exchange for agents

Unofficial, safety-first agent tooling for the xRocket Exchange API: one MCP server, one agent skill, and one Codex plugin bundle.

The default installation is intentionally public and read-only. Private account access and financial writes are available only in explicit local profiles, with separate feature gates and a prepare/execute approval flow. This project is not affiliated with, endorsed by, or operated by xRocket.

Connect in under a minute · Open xRocket · Official API overview · Coverage · Safety model · Legal review · Distribution status

What is included

The API surface was re-audited on 2026-08-24 and still covers all 50 Exchange documentation pages, all 26 OpenAPI operations, and all 7 WebSocket channels. The four linked legal PDFs were reviewed separately on 2026-08-07. The current OpenAPI document has canonical SHA-256 5de074def6ee9f59c7c1d1a2f8a06e1f5e2fafb446ebef58af7168e32813e2a3. See the source inventory.

Related MCP server: tossinvest-openapi-mcp

Tool profiles

For normal questions, xrocket_market_snapshot resolves a symbol or base asset and returns rules, ticker, best bid/ask, recent trades, fees, and an Open xRocket next action in one call. Private mode adds xrocket_account_overview for funding balances, trading balances, and active orders without inventing portfolio valuation. Narrow tools remain available for detailed queries. Full mode adds guarded order, cancel, internal-transfer, and withdrawal workflows.

Quick start — no installation

Open the zero-install connection page or add this URL to any MCP client that supports Streamable HTTP:

https://xrocket-mcp-production.up.railway.app/mcp

Generic client configuration:

{
  "mcpServers": {
    "xrocket": {
      "url": "https://xrocket-mcp-production.up.railway.app/mcp"
    }
  }
}

The hosted service is structurally limited to the 10 public mainnet tools. It never reads tokens, account data, or financial-write settings. Its health endpoint is /health.

For balances, order history, or guarded financial actions, use the local package below and authenticate only through your local process environment. Never paste an xRocket token into chat or send it to the hosted endpoint.

Local package

Requirements: Node.js 20 or newer. No clone or configuration is needed for public market data:

npx -y xrocket-mcp@0.4.0 doctor
npx -y xrocket-mcp@0.4.0 config

The second command prints this copy-paste MCP client configuration:

{
  "mcpServers": {
    "xrocket": {
      "command": "npx",
      "args": ["-y", "xrocket-mcp@0.4.0"],
      "env": {
        "XROCKET_ENVIRONMENT": "mainnet",
        "XROCKET_ENABLE_TRADING": "false",
        "XROCKET_ENABLE_TRANSFERS": "false",
        "XROCKET_ENABLE_WITHDRAWALS": "false",
        "XROCKET_ALLOW_MAINNET_WRITES": "false"
      }
    }
  }
}

The Codex bundle is described by plugins/xrocket-exchange/.codex-plugin/plugin.json, and its safe defaults are already set in plugins/xrocket-exchange/.mcp.json. Register this repository's marketplace, then install the all-in-one plugin:

codex plugin marketplace add nakazanie-ton/myrocket --ref main
codex plugin add xrocket-exchange@xrocket-agents

For a local clone, replace the first command with codex plugin marketplace add /absolute/path/to/myrocket.

For source development:

git clone https://github.com/nakazanie-ton/myrocket.git
cd myrocket/plugins/xrocket-exchange
npm ci
npm test
npm run build

The current package is xrocket-mcp@0.4.0.

Enabling private reads

Create a dedicated xRocket API bot token and pass it only through the process environment. With a token present, the profile defaults to private-read; an explicit profile is still respected:

export XROCKET_ENVIRONMENT=testnet
export XROCKET_API_TOKEN='replace-with-your-token'
node dist/cli.js

Never put the bearer token in a prompt, tool argument, committed MCP file, issue, or log. xRocket describes one broad bearer credential rather than fine-grained scopes, so treat it as full account access.

Enabling a write capability

full does not enable writes by itself. Enable only the capability you need:

export XROCKET_PROFILE=full
export XROCKET_ENVIRONMENT=testnet
export XROCKET_API_TOKEN='replace-with-your-token'
export XROCKET_ENABLE_TRADING=true
# XROCKET_ENABLE_TRANSFERS and XROCKET_ENABLE_WITHDRAWALS remain false
node dist/cli.js

Every write is two-stage:

1. Call the matching *_prepare tool. It validates inputs, reads relevant limits/state, stores the exact prepared intent in server memory, and returns a short-lived approval receipt.

2. Show the proposed action to the user and obtain explicit approval.

3. Call the matching *_execute tool once with only that receipt. The server retrieves the stored intent; the receipt is single-use and writes are never automatically retried.

4. If the network outcome is ambiguous, reconcile by client identifier before considering any retry.

The receipt binds execution to the prepared payload, but it is not proof that a human approved it. Once a client exposes full execute tools and the corresponding gate is enabled, an agent can technically call them. Use a client with a trusted approval UI or an out-of-band operator policy; otherwise keep the execute capability disabled.

Mainnet writes additionally require XROCKET_ENVIRONMENT=mainnet and XROCKET_ALLOW_MAINNET_WRITES=true. See configuration and safety details.

Important API boundaries

• The Exchange API has no deposit-address or create-deposit endpoint. xrocket_onboarding_links provides the configured UI path; balances can be refreshed afterward.

• Exchange POST /api/v1/accounts/transfers moves funds only between the same user's funding and trading accounts. It is not a user-to-user payment tool.

• xRocket Pay is a different product, uses different authentication, and is outside this server.

• The official API currently uses asset identifier TONCOIN in places where the UI may say TON.

• The 0.4.0 server uses REST snapshots. WebSocket channels are audited but not exposed until the upstream documentation defines reliable replay, gap recovery, and orderbook delta deletion semantics.

• Decimal financial values remain strings. Do not coerce them through binary floating point.

Development

cd plugins/xrocket-exchange
npm ci
npm test
npm run typecheck
npm run build
npm pack --dry-run

CI also checks the recorded documentation inventory and OpenAPI digest for drift. No live private credentials are used in tests.

Policy and support

This software can submit trades, transfers, and blockchain withdrawals when a local operator explicitly enables those capabilities. Review SECURITY.md, PRIVACY.md, TERMS.md, the project's legal and policy review, and xRocket's canonical terms and policies guide before use.

OpenAI's public plugin directory rules currently prohibit tools that execute investment trades, money transfers, or cryptocurrency transfers. The full profile is therefore not eligible for that public directory. Only the separately built hosted endpoint is a public-directory candidate; it contains no private or financial-write tool registrations.

Report defects through GitHub Issues. Report vulnerabilities privately as described in SECURITY.md.