PredMCP
Safe, read-only market data for AI trading agents, offering 44 tools to query prediction markets, perpetuals, and cross-venue signals without the ability to execute trades.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
RavioleLabs
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
create_api_keyGenerate a free PredMCP API key. Requires an email. Returns the key and ready-to-use MCP config. Free tier: 100 calls/day, one key per IP.
get_marketsLive prediction markets from Polymarket and/or HIP-4, sorted by volume. Returns title, YES/NO prices, 24h volume, and expiry.
get_oddsCurrent YES/NO prices and implied probability for any Polymarket or HIP-4 market token.
get_orderbookFull orderbook depth (bids + asks) for any Polymarket market token. Shows liquidity at each price level.
search_marketsFull-text search across all Polymarket and HIP-4 prediction markets. Returns ranked results with current odds.
get_whale_positionsPositions of a specific Polymarket wallet, optionally filtered to one market. The /positions API requires a user (no public "all holders by market" endpoint), so pass the wallet address of the trader you want to inspect.
get_moversTop prediction markets ranked by 24h volume spike or biggest YES/NO price swing. Surfaces breaking news bets and momentum plays across Polymarket and HIP-4.
get_markets_near_resolutionPolymarket markets resolving within the next N hours with a leading probability above threshold. Useful for resolution arbitrage and last-minute positioning.
get_volume_spikesPolymarket markets with abnormal 24h volume vs their 7-day daily average. Volume spikes typically precede news events or informed positioning.
get_late_game_sportsSports prediction markets on Polymarket closing within a few hours with a high-certainty leading outcome. Targets near-certain resolution for late-game positioning.
get_funding_ratesCurrent funding rates for Hyperliquid perpetuals. Positive rate = longs pay shorts (bearish bias); negative = shorts pay longs (bullish bias).
get_whale_tradesRecent large trades on Hyperliquid perps above a notional threshold. Includes side (long/short), size, price, and timestamp.
get_top_funding_ratesTop Hyperliquid perps ranked by absolute funding rate, with OI and annualized yield. Useful for finding the most overcrowded longs/shorts and carry opportunities.
get_oi_near_capLists Hyperliquid perps that are currently at the open interest cap — new long positions cannot be opened. Use as a blacklist to avoid getting rejected on entry.
get_orderbook_depthFull orderbook depth + slippage estimate for any Hyperliquid perp or HIP-4 market. Returns top of book, spread, cumulative depth at $100/$500/$1k/$5k tiers, and estimated slippage for a given order size. Critical for HIP-4 farming and low-liquidity assets where market orders get destroyed by slippag…
get_price_summaryOne-call snapshot for an asset: mark price, 24h and 7d returns, 30d high/low, drawdown from high, rally from low, annualized realised volatility. Computed from 30d of HL hourly candles.
get_basic_macroDXY, US10Y yield, S&P 500, gold, VIX — direct from free Yahoo Finance. Raw values + 1d change. Pro adds BTC dominance, ETH/BTC, total crypto mcap, and a RISK_ON/OFF regime classifier.
get_recent_newsRecent crypto news headlines matching an asset ticker, from CoinDesk + The Block + Decrypt + Cointelegraph RSS feeds. Pro adds the 1h price move that followed each headline.
get_simple_ivBTC or ETH options snapshot via free Deribit public feed: ATM implied volatility, total OI, 24h volume. Pro adds put-call skew + full term structure parsing.
get_recent_signalsServer-detected events from the last hour: funding outliers (≥3x 7d baseline), whale trades (≥$100k), OI caps reached. Cursor-based — pass next_cursor back as since_id to receive only new events. The polling equivalent of the /sse/signals stream. Pro tool get_signal_history covers 7 days with forwar…
get_oi_historyOpen-interest time series for a coin over the last 24h, from our continuous 5-min collector. Hyperliquid has NO OI-history endpoint — this data exists only on predmcp. Includes price + funding at each point. Pro tool get_oi_divergence classifies price-vs-OI regimes (squeeze/liquidation/new positioni…
get_market_regimeOne-call market regime classifier: RISK_ON_TRENDING / RISK_OFF / SQUEEZE_RISK / CHOP_LOW_VOL / MIXED. Combines BTC trend + realized vol, Deribit IV premium, funding breadth, and OI-weighted crowding across the top 50 perps. Call this FIRST each session to condition strategy choice.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
Fastify's Content-Type header tab character allows body validation bypass
Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass
fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections
ADMIN_SECRETDATA_DIREMAIL_FROMETHERSCAN_API_KEYIP_HASH_PEPPER"$(openssl rand -hex 32)" npm startLOG_LEVELRESEND_API_KEYSTRIPE_PRICE_IDSTRIPE_SECRET_KEYSTRIPE_WEBHOOK_SECRETTRUST_PROXYPORTTool annotations
1/22 tools have annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
22/22 tools missing one or more hints — create_api_key (missing: destructiveHint, idempotentHint); get_markets (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_odds (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +19 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool test coverage
Only 4/22 tools referenced in tests (18%)
Write tests that reference each tool by name so every tool has at least one test.
Production dependencies are patched
0 critical, 2 high severity in production deps — fastify@5.0.0 (high), fastify@5.0.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
2 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/raviolelabs/predmcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check