TradeStaq — AI Trading Intelligence (the-staq/tradestaq-mcp) is an MCP server listed on the M8ven Trust Index. It scores 69 out of 100, grade C. It declares 34 tools. No publisher has claimed this listing.

C
Caution
69/100

TradeStaq — AI Trading Intelligence

31 AI-powered trading tools. Create strategies, backtest, deploy bots, copy top traders, and manage crypto\r\n portfolios on Binance, Bybit, OKX, and more. Works with Claude, Cursor, and any MCP client.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

the-staq

Source: mcp.so · also listed on github_code, Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

⏳ This MCP is queued for scoring. Check back in a few minutes.
// key findings
⚠️
Tool descriptions don’t match what handlers do
1 tool describes read intent but its handler mutates — authenticate (line 296: execFile(openCmd, [authorizeUrl.href], () => {)
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 1 credential: TRADESTAQ_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes34 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

suggest_strategies

Suggest trading strategies matching your risk profile. Filters by risk tolerance, max drawdown, preferred assets, and minimum Sharpe ratio.

get_market_context

Get a market read for a symbol: trend direction, volatility level, and key support/resistance levels. Use it to inform a strategy or trade decision, or to ground market commentary in current conditions. Read-only — never places orders. Get exchange IDs from list_exchanges.

login

Log in to TradeStaq with email and password and store the returned access token locally. Simple credential login for automation and headless use; for interactive users prefer authenticate (browser OAuth, where credentials never enter the chat). Credentials are sent directly to the TradeStaq API over

authenticate

Log in to TradeStaq via browser. Opens a login page in your browser — you authenticate there and the token is saved automatically. No credentials enter the chat. Scope controls what the agent can do: "mcp:read" (view-only research agents), "mcp:paper" (paper-trade bots, safe default — cannot touch

check_auth

Preflight check before invoking other tools. Returns the authenticated user, OAuth scope on the current token (mcp:read / mcp:paper / mcp:live), tier capabilities (allowLiveTrading, allowAIBuilder, allowNewsTrading, allowMcpServer), Strategy Lab wallet balance (for cost-charging tools like generate_

set_token

Manually store a TradeStaq JWT access token instead of logging in through the browser. Advanced / automation use only — most users should call authenticate (browser OAuth) or login (email + password) instead. The token is saved locally to ~/.tradestaq/mcp-config.json with an assumed 7-day expiry. Us

connect_exchange

Connect a new exchange account via browser. Opens a page where you securely enter your exchange API keys. Keys never enter the chat.

logout

Remove the stored TradeStaq credentials from local config (~/.tradestaq/mcp-config.json), signing the user out. Also clears the cached OAuth client so the next authenticate registers cleanly — call this before re-authenticating with a different scope.

what_if_backtest

Run a backtest on a strategy. Async, may take 30-120 seconds. Returns full performance metrics.

get_backtest_results

Check status/results of a previously started backtest.

export_backtest

Get export links for a completed backtest. Returns CSV and PDF download URLs.

list_bots

List all your trading bots with status and performance.

get_bot_status

Get detailed status, configuration, and live performance for a specific trading bot by ID. Returns its run status, the strategy/symbol/exchange it trades, whether it is paper or live, P&L, win rate, total trades, and risk config (leverage, stop-loss, take-profit). Use it to check how a deployed bot

deploy_bot

Deploy a strategy as a trading bot. Defaults to paper trading for safety.

stop_bot

Stop a running trading bot so it stops opening new positions. Any positions it currently holds stay open — close those separately with close_position. The bot and its config are kept and can be restarted later, so this is a reversible state change, not a delete. Check state first with get_bot_status

export_bot_trades

Export a bot's trade history as structured data — every closed trade with entry/exit prices and P&L, plus a performance summary. Use it to review or report on how a specific bot has performed. Read-only. Get bot IDs from list_bots.

close_position

Close an open trading position by placing a market order — fully or partially. This moves real money when the position is live, so confirm intent with the user before calling. Find the tradeId, exchangeId, and symbol with get_positions. Set percentage below 100 for a partial close.

list_top_traders

Browse the leaderboard of top-performing traders you can copy.

follow_trader

Subscribe to copy a top trader's trades. WARNING: This commits capital to copy trading.

get_price

Get the current price of a trading pair, along with its 24h change and volume, from a connected exchange. Use it for a quick spot-price check or to confirm the market before sizing or placing a trade. Read-only — never places orders. For historical OHLCV data use get_candles.

get_candles

Fetch OHLCV (open/high/low/close/volume) candlestick data for a trading pair from a connected exchange. Use it to analyze price action, compute indicators, or ground a trading decision in real market data before backtesting or deploying a strategy. Returns the candles plus the latest candle and the

list_exchanges

List your connected exchange accounts with their IDs, platform names, and status.

create_paper_exchange

Create a paper-trading exchange with a simulated balance. No API keys required. Paper exchanges let agents test strategies, deploy bots, and place trades without risking real money. Recommended starting point for first-time users and any scope=mcp:paper workflow. Requires OAuth scope mcp:paper or m

search_markets

Search for trading pairs on a specific exchange. Use list_exchanges to find your exchange IDs.

get_portfolio

Get portfolio overview: total balance, exchanges, and active bots.

get_positions

Get all open trading positions with current PnL.

list_strategies

List available trading strategies — either the public marketplace or the user's own library. Use it to discover strategies to backtest or deploy, or to find strategy IDs for get_strategy, compare_strategies, and deploy_bot. Read-only.

get_strategy

Get full details for a specific strategy by ID: description, market/timeframe, performance stats, rating, and code metadata. Use it to inspect a strategy before backtesting, deploying, or comparing. Read-only. Get IDs from list_strategies; use compare_strategies for side-by-side comparison and expla

explain_strategy

Get a plain-English explanation of a strategy: what it does, risk profile, best market conditions.

compare_strategies

Compare 2-5 strategies side by side on their key performance metrics: ROI, max drawdown, win rate, Sharpe ratio, rating, and active bot count. Use this to help a user choose between strategies from the marketplace or their own library before backtesting or deploying one. Read-only. Get strategy IDs

create_strategy

Save a new trading strategy from existing TradeDroid strategy code to the user's library, so it can be backtested or deployed. Use this when you already have the code (hand-written or produced by generate_strategy). To create a strategy from a natural-language description instead of code, use genera

generate_strategy

Generate a complete trading strategy from a natural-language description using AI (FORGE). Describe the idea and it writes runnable TradeDroid strategy code — no coding required — then saves it so you can validate with what_if_backtest and deploy with deploy_bot. The fastest path from idea to a depl

get_trade_history

Get the user's closed trade history across exchanges — entry/exit prices, P&L, and holding duration per trade, with pagination. Use it to review past trades or answer questions about specific fills. Read-only. For aggregate metrics (ROI, win rate, Sortino) use get_performance_metrics instead.

get_performance_metrics

Get aggregate trading performance metrics over a time range: ROI, win rate, total P&L, and Sortino ratio. Use it to summarize how the user (or a subset of their trading) is performing. Read-only. For a list of individual trades use get_trade_history.

// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configMCP_PORT
configMCP_PUBLIC_URL
configTRADESTAQ_BASE_URL
🔐 secretTRADESTAQ_TOKEN
// quality suggestions

Tool annotations

17/34 tools have annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

31/34 tools missing one or more hints — suggest_strategies (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_market_context (missing: destructiveHint, idempotentHint); authenticate (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +28 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Descriptions match behaviour

1 tool describes read intent but its handler mutates — authenticate (line 296: execFile(openCmd, [authorizeUrl.href], () => {)

Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.

Tool inputs are validated

Only 2/6 tool handlers declare input schemas (33%)

Declare an inputSchema with zod/joi/yup on every tool definition.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tool test coverage

Only 5/34 tools referenced in tests (15%)

Write tests that reference each tool by name so every tool has at least one test.

Tool description accuracy

authenticate: description implies read-only but handler writes/deletes/executes

Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/the-staq/tradestaq-mcp?variant=verified)](https://m8ven.ai/mcp/the-staq/tradestaq-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 04b11cf76fd2515eea347409bb0f5c1cfb7bc9c7
code hash: 1ed3e302c7236adb152c7099b455c62a3d20704182e54c2e29a560ddd8a4da08
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client