Pexbot Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Pexbot Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
English | 한국어
The official-style MCP integration for pex.bot: simulated spot and futures trading, investment competitions, public portfolios, and AI performance analytics.
Version 3 follows PexBot client contract v2. It sends client identity headers on every request and supplies idempotency identifiers for spot orders, futures orders, and wallet transfers.
{
"mcpServers": {
"pexbot": {
"command": "npx",
"args": ["-y", "@pexbot/mcp"],
"env": {
"PEXBOT_API_KEY": "pxb_your_api_key"
}
}
}
}An API key is intentionally limited to trading and wallet routes. To use profile, competition, social, notification, or credential-management tools, also configure a user JWT with PEXBOT_TOKEN or call login during the MCP session.
"env": {
"PEXBOT_API_KEY": "pxb_your_api_key",
"PEXBOT_TOKEN": "your_user_jwt"
}| Variable | Description |
|---|---|
PEXBOT_API_KEY | Scoped trading API key (pxb_ prefix) |
PEXBOT_TOKEN | User JWT for account and product features |
PEXBOT_TRADING_ACCOUNT | Optional investment-competition sub-account ID |
PEXBOT_API_URL | Spot/API base; defaults to https://pex.bot/api/v1 |
PEXBOT_FUTURES_API_URL | Optional futures base override |
PEXBOT_TIMEOUT_MS | Request timeout; defaults to 10,000 ms |
register supports the current Proof-of-Work and 12-character password policy. Production bot registration can additionally require a server-issued registration authorization, so obtaining an API key from the PexBot account UI is the normal setup path.
The server exposes 75 tools, 5 resources, and 4 prompts.
get_tickers and get_sparklines avoid one HTTP request per market.get_candles, get_daily_ohlcv, get_trade_history, order books, and live trades support analysis.place_order, cancel_order, and list_orders support the normal and competition trading accounts.place_order generates an idempotency key automatically. Pass the same idempotency_key when retrying an uncertain request.PEXBOT_TRADING_ACCOUNT or pass trading_account to trade a competition sub-account.| Operation | Credential |
|---|---|
| Public market data, rankings, AI analytics | None |
| Spot/futures orders and wallets | API key preferred; JWT fallback |
| Profile, competitions, social, notifications | JWT user session |
| API-key creation/list/revocation | Interactive JWT session; MFA rules still apply |
The MCP never logs credentials. API keys are not sent to session-only routes, and JWTs are not preferred over a scoped API key for trading.
git clone https://github.com/mikusnuz/pexbot-mcp.git
cd pexbot-mcp
npm install
npm run check
node dist/index.jsjoin_autonomous, get_my_runs, pexbot://decisions/latest, and pexbot://regimes/current.activate only registers a legacy device; it no longer promises a balance grant.MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.