Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP (Model Context Protocol) server that enables Claude and Gemini CLI to interact with Hummingbot for automated cryptocurrency trading across multiple exchanges.
curl -LsSf https://astral.sh/uv/install.sh | sh git clone https://github.com/hummingbot/mcp
cd mcp
uv sync cp .env.example .env HUMMINGBOT_API_URL=http://localhost:8000
HUMMINGBOT_USERNAME=admin
HUMMINGBOT_PASSWORD=admin {
"mcpServers": {
"hummingbot-mcp": {
"type": "stdio",
"command": "uv",
"args": [
"--directory",
"/path/to/mcp",
"run",
"main.py"
]
}
}
}Note: Make sure to replace /path/to/mcp with the actual path to your MCP directory.
touch .env HUMMINGBOT_API_URL=http://localhost:8000
HUMMINGBOT_USERNAME=admin
HUMMINGBOT_PASSWORD=adminImportant: When running the MCP server in Docker and connecting to a Hummingbot API on your host:
--network host (see below) to allow the container to access localhost:8000HUMMINGBOT_API_URL to http://host.docker.internal:8000 docker pull hummingbot/hummingbot-mcp:latestFor Linux (using --network host):
{
"mcpServers": {
"hummingbot-mcp": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"--network",
"host",
"--env-file",
"/path/to/mcp/.env",
"-v",
"$HOME/.hummingbot_mcp:/root/.hummingbot_mcp",
"hummingbot/hummingbot-mcp:latest"
]
}
}
}For Mac/Windows:
{
"mcpServers": {
"hummingbot-mcp": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"--env-file",
"/path/to/mcp/.env",
"-v",
"$HOME/.hummingbot_mcp:/root/.hummingbot_mcp",
"hummingbot/hummingbot-mcp:latest"
]
}
}
}(Remember to set HUMMINGBOT_API_URL=http://host.docker.internal:8000 in your .env file)
Note: Make sure to replace /path/to/mcp with the actual path to your MCP directory.
For cloud deployment where both Hummingbot API and MCP server run on the same server:
touch .env HUMMINGBOT_API_URL=http://localhost:8000
HUMMINGBOT_USERNAME=admin
HUMMINGBOT_PASSWORD=admin services:
hummingbot-api:
container_name: hummingbot-api
image: hummingbot/hummingbot-api:latest
ports:
- "8000:8000"
volumes:
- ./bots:/hummingbot-api/bots
- /var/run/docker.sock:/var/run/docker.sock
environment:
- USERNAME=admin
- PASSWORD=admin
- BROKER_HOST=emqx
- DATABASE_URL=postgresql+asyncpg://hbot:hummingbot-api@postgres:5432/hummingbot_api
networks:
- emqx-bridge
depends_on:
- postgres
mcp-server:
container_name: hummingbot-mcp
image: hummingbot/hummingbot-mcp:latest
stdin_open: true
tty: true
env_file:
- .env
environment:
- HUMMINGBOT_API_URL=http://hummingbot-api:8000
depends_on:
- hummingbot-api
networks:
- emqx-bridge
# Include other services from hummingbot-api docker-compose.yml as needed
emqx:
container_name: hummingbot-broker
image: emqx:5
restart: unless-stopped
environment:
- EMQX_NAME=emqx
- EMQX_HOST=node1.emqx.local
- EMQX_CLUSTER__DISCOVERY_STRATEGY=static
- EMQX_CLUSTER__STATIC__SEEDS=[[email protected]]
- EMQX_LOADED_PLUGINS="emqx_recon,emqx_retainer,emqx_management,emqx_dashboard"
volumes:
- emqx-data:/opt/emqx/data
- emqx-log:/opt/emqx/log
- emqx-etc:/opt/emqx/etc
ports:
- "1883:1883"
- "8883:8883"
- "8083:8083"
- "8084:8084"
- "8081:8081"
- "18083:18083"
- "61613:61613"
networks:
emqx-bridge:
aliases:
- node1.emqx.local
healthcheck:
test: [ "CMD", "/opt/emqx/bin/emqx_ctl", "status" ]
interval: 5s
timeout: 25s
retries: 5
postgres:
container_name: hummingbot-postgres
image: postgres:15
restart: unless-stopped
environment:
- POSTGRES_DB=hummingbot_api
- POSTGRES_USER=hbot
- POSTGRES_PASSWORD=hummingbot-api
volumes:
- postgres-data:/var/lib/postgresql/data
ports:
- "5432:5432"
networks:
- emqx-bridge
healthcheck:
test: ["CMD-SHELL", "pg_isready -U hbot -d hummingbot_api"]
interval: 10s
timeout: 5s
retries: 5
networks:
emqx-bridge:
driver: bridge
volumes:
emqx-data: { }
emqx-log: { }
emqx-etc: { }
postgres-data: { } docker compose up -d {
"mcpServers": {
"hummingbot-mcp": {
"type": "stdio",
"command": "docker",
"args": [
"exec",
"-i",
"hummingbot-mcp",
"uv",
"run",
"main.py"
]
}
}
}Note: Replace hummingbot-mcp with your actual container name. You can find the container name by running:
docker psOn first run, the server creates a default configuration from environment variables (or uses http://localhost:8000 with default credentials). Configuration is stored in ~/.hummingbot_mcp/server.yml.
# Show the current server configuration
configure_server()
# Update the host and port
configure_server(host="192.168.1.100", port=8001)
# Update credentials
configure_server(username="admin", password="secure_password")
# Update everything at once
configure_server(
name="production",
host="prod-server",
port=8000,
username="admin",
password="secure_password"
)Only the provided parameters are changed; omitted ones keep their current values. The client automatically reconnects after any update.
The following environment variables can be set in your .env file for the MCP server:
| Variable | Default | Description |
|---|---|---|
HUMMINGBOT_API_URL | http://localhost:8000 | Initial default API server URL (used only on first run) |
HUMMINGBOT_USERNAME | admin | Initial username (used only on first run) |
HUMMINGBOT_PASSWORD | admin | Initial password (used only on first run) |
HUMMINGBOT_TIMEOUT | 30.0 | Connection timeout in seconds |
HUMMINGBOT_MAX_RETRIES | 3 | Maximum number of retry attempts |
HUMMINGBOT_RETRY_DELAY | 2.0 | Delay between retries in seconds |
HUMMINGBOT_LOG_LEVEL | INFO | Logging level (DEBUG, INFO, WARNING, ERROR, CRITICAL) |
Note: After initial setup, use the configure_server tool to update the server connection. Environment variables are only used to create the initial default configuration.
The MCP server provides tools for:
~/.hummingbot_mcp/server.ymlTo run the server in development mode:
uv run main.pyTo run tests:
uv run pytestThe MCP server now provides comprehensive error messages to help diagnose connection and authentication issues:
If you see error messages like:
❌ Cannot reach Hummingbot API at <url> - The API server is not running or not accessible❌ Authentication failed when connecting to Hummingbot API - Incorrect username or password❌ Failed to connect to Hummingbot API - Generic connection failureThe error messages will include:
configure_serverconfigure_server tool to update server credentials.env file configurationconfigure_server tool to update the server URLhost.docker.internal instead of localhost--network host in your Docker configurationhost.docker.internal:8000 as the API URLThe MCP server will:
configure_server) to fix issues~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.