Config is the same across clients — only the file and path differ.
{
"mcpServers": {
"traderouter": {
"env": {
"TRADEROUTER_PRIVATE_KEY": "your_base58_private_key"
},
"args": [
"-y",
"@traderouter/trade-router-mcp"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
A Model Context Protocol server for TradeRouter.ai — Solana swap & limit order engine.
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y '@traderouter/trade-router-mcp' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories — click any category to see the underlying evidence.
No known CVEs.
Checked @traderouter/trade-router-mcp against OSV.dev.
Click any tool to inspect its schema.
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Others in finance
Real-time financial market data: stocks, forex, crypto, commodities, and economic indicators
A Model Context Protocol server for building an investor agent
AI agents get on-chain identity, credentials, reputation, escrow, and persistent memory on XRPL.
Remote MCP server to integrate and validate self-hosted PayRam deployments.
MCP Security Weekly
Get CVE alerts and security updates for io.github.re-bruce-wayne/trade-router-mcp and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
A Model Context Protocol server for TradeRouter.ai — non-custodial Solana swap, limit, trailing, DCA, TWAP, and combo-order engine for AI agents.
Yes, and here's exactly why. The private key is read once from TRADEROUTER_PRIVATE_KEY, used for local signing with @solana/web3.js + tweetnacl, and never transmitted, logged, or persisted. Only signed transactions leave your machine. Server messages are Ed25519-verified against a hard-coded trust anchor. See SECURITY.md for the full threat model, data-flow diagram, and permissions manifest.
Signing flow:
build_swap → MCP sends wallet address (public key) to api.traderouter.aiTRADEROUTER_PRIVATE_KEY/protect (Jito MEV-protected bundle)npx -y @traderouter/trade-router-mcp
Or wire it into an MCP client (Claude Desktop, Cursor, Cline, etc.):
{
"mcpServers": {
"traderouter": {
"command": "npx",
"args": ["-y", "@traderouter/trade-router-mcp"],
"env": {
"TRADEROUTER_PRIVATE_KEY": "your_base58_private_key"
}
}
}
}
| OS | Claude Desktop config path |
|---|---|
| macOS | ~/Library/Application Support/Claude/claude_desktop_config.json |
| Windows | %APPDATA%\Claude\claude_desktop_config.json |
| Linux | ~/.config/Claude/claude_desktop_config.json |
| Variable | Required | Default | Purpose |
|---|---|---|---|
TRADEROUTER_PRIVATE_KEY | ✅ | — | Solana wallet private key (base58). Local use only. |
SOLANA_RPC_URL | ❌ | https://api.mainnet-beta.solana.com | Custom RPC for reads |
TRADEROUTER_SERVER_PUBKEY | ❌ | baked-in trust anchor | Override the server's Ed25519 trust anchor |
TRADEROUTER_SERVER_PUBKEY_NEXT | ❌ | (unset) | Accept messages signed by this key in addition to the primary (key rotation) |
TRADEROUTER_REQUIRE_SERVER_SIGNATURE | ❌ | true | Verify server signatures on order_filled / twap_execution |
TRADEROUTER_REQUIRE_ORDER_CREATED_SIGNATURE | ❌ | true | Verify server signatures on order_created |
TRADEROUTER_DRY_RUN | ❌ | false | When true, every write-action tool (submit_signed_swap, auto_swap, place_*_order, cancel_order, extend_order) returns { dry_run: true, tool, args } instead of calling the API. Read-only tools execute normally. Added in 1.0.9. |
| Tool | Purpose |
|---|---|
get_wallet_address | Get the configured wallet |