deribit-mcp (schoeffeljp/deribit-mcp) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 35 tools. No publisher has claimed this listing.

D
Caution
54/100

deribit-mcp

Connects to Deribit for real-time market data, portfolio management, trade execution, and risk analysis through natural language.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

schoeffeljp

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Known vulnerabilities in dependencies: 1 critical, 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 2 credentials: DERIBIT_CLIENT_SECRET, MCP_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes35 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

analyze_position

PREFERRED tool for position analysis — returns fee-aware NET P&L (after actual entry fees from trade history + estimated exit fees at ~$0.9/contract taker), realistic exit simulation at bid/ask (not mark), DTE, greeks, moneyness, risk flags, and HOLD/TAKE_PROFIT/CLOSE/ROLL recommendations. Always us

portfolio_risk_metrics

Portfolio-level risk dashboard with dollar greeks, theta/netliq ratio, delta/theta ratio, margin utilization, concentration per underlying, and health status (HEALTHY/CAUTION/AT_RISK). Based on Tasty Trade risk framework.

iv_rank

Get IV Rank, IV Percentile, HV30, and Volatility Risk Premium (VRP) for a cryptocurrency. IV Rank > 50 = rich (good for selling premium), < 30 = cheap (good for buying).

scan_candidates

Scan for option trading opportunities by strategy (naked_put, strangle, covered_call). Returns ranked candidates with premium, delta, IV, margin, annualized yield, and position sizing recommendations.

get_account_summary

Get account balance, equity, margin usage, and P&L summary for a currency.

get_positions

Get all open positions, including size, direction, P&L, average price, and greeks for options.

get_order_state

Get the current state of an order by its order_id. Returns order_state (open, filled, cancelled, rejected, untriggered), average_price, filled_amount, price, and all order details. Use this to check if an order was filled, partially filled, or cancelled.

get_open_orders

List all open (unfilled) orders, optionally filtered by currency or instrument type.

buy

Place a buy order on Deribit. Supports limit, market, stop_limit, and stop_market order types. Use with caution — this places a real trade.

sell

Place a sell order on Deribit. Supports limit, market, stop_limit, and stop_market order types. Use with caution — this places a real trade.

cancel_order

Cancel an open order by its order ID.

cancel_all_orders

Cancel all open orders, optionally filtered by currency and instrument type.

edit_order

Modify an existing open order's price, amount, or other parameters without cancelling and re-placing.

close_position

Close an existing position entirely. Places a market or limit order to flatten the position.

get_user_trades

Get recent trade fills for a currency. ALWAYS filter by kind (option, future, spot) to narrow results. Shows price, size, fees, P&L, IV, and underlying price. Use get_user_trades_by_instrument if you know the specific instrument name.

get_user_trades_by_instrument

Get trade history for a SPECIFIC instrument. Preferred when you know the instrument name (e.g. 'show me my fills on ETH_USDC-27MAR26-2400-C'). Returns price, size, fees, underlying price and IV at time of trade.

get_transaction_log

Get the full ledger of account transactions: trades, settlements, fees, funding payments, deposits, withdrawals, and transfers.

get_margins

Estimate the margin required for a hypothetical trade before placing it. Returns margin for both buy and sell sides, plus min/max price bounds.

get_currencies

List all available currencies on Deribit

get_instruments

List tradable instruments (options, futures, spots) for a currency. Returns instrument names, strike prices, expiration dates, and contract details. Essential for discovering available options chains.

get_ticker

Get real-time quote data for an instrument. For options, includes greeks (delta, gamma, vega, theta, rho), implied volatility, mark price, bid/ask, open interest, and volume.

get_order_book

Get the order book (bids and asks) for an instrument, including best bid/ask, mark price, and funding rate for perpetuals.

get_book_summary_by_currency

Get summary info (volume, open interest, bid/ask, mark price) for all instruments of a currency. Useful for scanning the entire options or futures market at a glance.

get_index_price

Get the current index price for a given underlying index (e.g. btc_usd, eth_usd).

get_historical_volatility

Get historical volatility data points for a currency index over time.

get_volatility_index

Get DVOL (Deribit Volatility Index) OHLCV data — Deribit's equivalent of the VIX. Shows implied volatility trend over time.

get_tradingview_chart_data

Get OHLCV candlestick data for any instrument. Useful for price charts, technical analysis, and historical price research.

get_funding_rate_history

Get historical funding rate data for a perpetual instrument. Shows hourly funding rates, index prices, and interest rates.

get_delivery_prices

Get historical settlement/delivery prices for an index. Useful for backtesting and understanding past expiry outcomes.

get_expirations

List available option expiration dates for a currency, sorted chronologically. For USDC currency, use 'underlying' to filter ETH vs BTC options.

get_options_chain

Get options chain for a specific currency + expiry. Returns strikes with bid/ask, mark price, IV, greeks, OI. IMPORTANT: always specify 'underlying' for USDC currency, and use 'atm_range' to limit strikes (default 10 = ATM ± 10).

find_options_by_delta

Find options closest to a target delta for a given currency and expiry. E.g., 'find the 25-delta put' or 'find the 50-delta call'. Returns the best matching options sorted by delta proximity.

get_volatility_surface

Get the implied volatility surface across all strikes and expirations for a currency. Returns a matrix of expiry × strike → IV, plus ATM IV and skew metrics per expiry. Essential for relative value analysis and vol trading.

get_portfolio_greeks

Get aggregated portfolio greeks across all open option positions for a currency. Shows total delta, gamma, vega, and theta exposure, plus per-position breakdown. Essential for understanding net risk.

get_portfolio_summary

One-shot overview of your entire account for a currency: balances, margin usage, equity, all open positions with P&L, and all open orders. Saves multiple API calls into a single comprehensive snapshot.

// known CVEs in dependencies1 critical3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@3.2.4GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

high@modelcontextprotocol/sdk@1.12.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configDERIBIT_CLIENT_ID"": "your_client_id",
🔐 secretDERIBIT_CLIENT_SECRET"": "your_client_secret",
configDERIBIT_TESTNET"": "true"
🔐 secretMCP_API_KEYgenerate_a_random_secret_here
configMCP_CORS_ORIGINNo Allowed CORS origin for HTTP mode
configMCP_TRANSPORTNo stdio stdio for local, http for cloud
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployPORT
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

35/35 tools missing one or more hints — analyze_position (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); portfolio_risk_metrics (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); iv_rank (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +32 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

34/35 tool handlers declare input schemas (97%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

Only 3/35 tool handlers wrap calls in try/catch (9%)

Wrap each tool handler body in try/catch and return a structured error response.

Tool test coverage

25/35 tools referenced in tests (71%)

Write tests that reference each tool by name so every tool has at least one test.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.1 (high), @modelcontextprotocol/sdk@1.12.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

1 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/schoeffeljp/deribit-mcp?variant=verified)](https://m8ven.ai/mcp/schoeffeljp/deribit-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 171c1720170cb42de6a5e468516696e87c8dacaa
code hash: fc10a88cc33e87084bf4336b2d30504830a60873d02d934869c3a4b4a62620d5
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client