simmer-mcp-setup-6f2fca — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited simmer-mcp-setup-6f2fca (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
One-shot bootstrap that wires the Simmer MCP server into your agent runtime. Read-once, run-once — after this completes, the skill itself isn't needed again.
The Simmer MCP gives your agent raw market/trade tools plus a small pinned catalog of core Simmer skills it can invoke as tools. Strategy skills such as polymarket-copytrading, polymarket-fast-loop, and kalshi-weather-trader install on demand from ClawHub instead of shipping inside the npm package.
What this MCP is for: querying markets, checking account state, placing guarded direct trades, and running the core bundled Simmer playbooks through your agent. For situational strategies, ask the agent to install the current ClawHub skill first (for example, clawhub install polymarket-copytrading) and then follow that skill's instructions. Real trades land on the configured venue — paper sim by default, real venues require an explicit triple opt-in (dry_run=false + venue=polymarket|kalshi + SIMMER_MCP_ALLOW_LIVE=true env var on the MCP server).
What this MCP doesn't do (yet): expose raw trade primitives like place_order or get_briefing as standalone tools. Ad-hoc operations like "buy $10 yes on this BTC market" or "show me my current portfolio" aren't possible through MCP today — those still need the Python SDK, which exposes client.trade(), client.get_briefing(), etc. directly. Raw MCP primitives are a tracked follow-up.
So: MCP and SDK are different shapes, both legitimate. MCP runs pre-built strategies through your agent with safety defaults; SDK builds custom logic with full primitive access.
simmer-mcp runnable via npx -y simmer-mcp (global install optional)simmer entrySIMMER_API_KEY plumbed into the MCP subprocesslist_skills, get_skill_docs, troubleshoot_errorsimmer, simmer-wallet-setup, simmer-mcp-setup, simmer-briefing, and preflight). Situational strategies such as combo, shock-ladder, copytrading, weather, and DCA install on demand from ClawHub so they stay current.simmer_get_markets, simmer_get_market_context, simmer_get_briefing, simmer_trade, portfolio/position tools, and guarded order cancellation.init_experiment, run_experiment, log_experiment, backtest_experiment) — only registered if you're on the Pro plan.This skill needs SIMMER_API_KEY to wire into the MCP config. Three cases:
Case A — key already in env. Verify:
[[ "$SIMMER_API_KEY" == sk_live_* ]] && echo "OK" || echo "MISSING or malformed"If "OK", skip to Step 2.
Case B — key from prior dashboard registration. Get it from simmer.markets/dashboard → your agent → API key tab. Paste it in (don't pipe from clipboard — pastes can pick up trailing characters):
read -s -p 'SIMMER_API_KEY: ' KEY && export SIMMER_API_KEY=$KEYCase C — no agent registered yet. Register one now:
curl -X POST https://api.simmer.markets/api/sdk/agents/register \
-H "Content-Type: application/json" \
-d '{"name": "my-agent", "description": "What this agent does"}'Response includes api_key and claim_url. Save the API key:
export SIMMER_API_KEY="sk_live_..."Send the claim_url to the human user — they need to visit it before any real-money trading is unlocked. Until then, all trades stay on the sim paper venue (this is intentional, not a bug).
The simmer-mcp server runs on Node.js. Check:
node --version # need v18 or higher
npm --versionIf both return a version → skip to Step 3.
If command not found, the user needs to install Node.js. Don't auto-install via `curl | sh` — it modifies the user's system without their approval. Instead, show them the platform-specific option:
| Platform | Recommended install |
|---|---|
| macOS | Download installer from nodejs.org (LTS) and double-click. Or brew install node if Homebrew is installed. |
| Windows | Download installer from nodejs.org (LTS) and double-click. |
| Linux (Debian/Ubuntu) | sudo apt update && sudo apt install nodejs npm |
| Linux (Fedora/RHEL) | sudo dnf install nodejs npm |
The Node.js installer bundles npm, so installing Node.js gives you both. After install, the user needs to reopen their terminal so node/npm land on PATH, then re-run this step.
Why not nvm? nvm is great for developers who switch Node versions across projects. For a one-time global install of a CLI tool like simmer-mcp, the official installer is simpler.
npm install -g simmer-mcpThis step is optional. The MCP config in Step 4 uses npx -y simmer-mcp, which fetches the package on first launch even without a global install. Installing globally just makes the first launch slightly faster (no fetch delay). If you skip Step 3, everything still works.
If you do install it and get an EACCES permission error on Linux/macOS: do NOT sudo npm install (creates permission tangles later). Either fix npm's global directory permissions per npm's docs, or just skip the global install — the npx -y simmer-mcp form in the config works either way.
Why no `--version` check? simmer-mcp's binary doesn't have CLI flags — every invocation starts the stdio MCP server. Verification happens in Step 6 when your agent calls a simmer tool and gets a real response.
Detect which runtime your agent is in, then write the right config. Pattern is "use the native CLI if the runtime has one; fall back to direct config-file write."
Decide scope first:
| Scope | What it means | Flag | Config file |
|---|---|---|---|
| User (global) | Simmer available in every Claude Code session, every project | -s user | ~/.claude.json |
| Local (default) | Simmer available only when Claude Code is run from the current directory tree | (none — default) | ~/.claude.json under per-cwd entries |
| Project | Simmer available to anyone working in this project (committed to repo) | -s project | .mcp.json in cwd |
Most onboarding flows want user scope — install once, available everywhere.
Preferred (no file editing):
claude mcp add -s user simmer -e SIMMER_API_KEY="$SIMMER_API_KEY" -- npx -y simmer-mcp⚠️ Flag order matters:-e KEY=valuegoes after the server namesimmer, then--, then the command. The example inclaude mcp add --helpputs-ebefore the name; that form fails because-eis variadic and greedily consumes the server name as an env var. The order shown here is the form that actually works in current Claude Code versions (verified on Claude Code via real add/remove cycle).
This writes ~/.claude.json for you with the correct command/args/env structure. The "$SIMMER_API_KEY" expansion bakes the literal key value into the config (MCP runtimes don't expand shell vars at server-launch time).
Fallback (if `claude mcp add` isn't available in this Claude Code version): add the following to ~/.claude.json under mcpServers (create the key if it doesn't exist) — use the literal API key value, not $VAR:
{
"mcpServers": {
"simmer": {
"command": "npx",
"args": ["-y", "simmer-mcp"],
"env": {
"SIMMER_API_KEY": "sk_live_..."
}
}
}
}For project scope instead: use the same JSON shape but write it to .mcp.json in the project root (single top-level mcpServers key, no other fields).
Edit ~/.cursor/mcp.json (create the file if it doesn't exist):
{
"mcpServers": {
"simmer": {
"command": "npx",
"args": ["-y", "simmer-mcp"],
"env": {
"SIMMER_API_KEY": "sk_live_..."
}
}
}
}Project-scoped: use .cursor/mcp.json in the project root.
Edit ~/.openclaw/openclaw.json and add simmer under mcp.servers:
{
"mcp": {
"servers": {
"simmer": {
"command": "npx",
"args": ["-y", "simmer-mcp"],
"env": {
"SIMMER_API_KEY": "sk_live_..."
}
}
}
}
}Restart your OpenClaw runtime so it picks up the new server.
Hermes uses YAML, not JSON. Edit ~/.hermes/config.yaml and add under mcp_servers (snake_case — different from the other runtimes):
mcp_servers:
simmer:
command: "npx"
args: ["-y", "simmer-mcp"]
env:
SIMMER_API_KEY: "sk_live_..."
enabled: trueThe canonical Codex MCP config path varies by install — consult Codex's MCP docs for the exact file. The block to add is the standard MCP shape:
{
"mcpServers": {
"simmer": {
"command": "npx",
"args": ["-y", "simmer-mcp"],
"env": {
"SIMMER_API_KEY": "sk_live_..."
}
}
}
}If you're on a runtime not listed above but it speaks MCP, you almost certainly need this exact block in its MCP-server config file (check the runtime's docs for where that lives):
{
"mcpServers": {
"simmer": {
"command": "npx",
"args": ["-y", "simmer-mcp"],
"env": {
"SIMMER_API_KEY": "sk_live_..."
}
}
}
}MCP servers are loaded at startup. Quit and reopen your agent runtime so it picks up the new simmer entry. Some runtimes (OpenClaw, Hermes daemon mode) have a reload command — use that instead of a full restart if available.
Don't trust "looks installed" — verify with a real tool call.
Ask your agent:
What simmer tools can you see? List them.
The agent should respond with the 3 utility tools, raw market/trade tools, and the core bundled skill tools:
list_skillsget_skill_docstroubleshoot_errorsimmer_simmer, simmer_simmer_wallet_setup, simmer_simmer_mcp_setup, simmer_simmer_briefing, simmer_preflight)simmer_get_markets, simmer_get_market_context, simmer_get_briefing, simmer_trade, and portfolio/position tools)Then ask the agent to do something safe that exercises the API:
Use the simmer tools to show me a few of the most active markets on the sim venue.
The sim venue is paper money — no real funds at risk. If this returns market data, the handshake works end-to-end and Simmer is ready to use.
Agent says "no simmer tools available" after restart.
cat ~/.claude.json (or equivalent) and look for the simmer entry under mcpServers.claude mcp list shows registered servers and their status.Tools listed but API calls return 401.
SIMMER_API_KEY env didn't make it into the MCP subprocess. The env block in the config has to be a direct value, not a $VAR reference — most MCP clients don't expand shell vars at server-launch time.printenv SIMMER_API_KEY | cut -c1-20 — must start with sk_live_. A common silent failure: install commands that use pbpaste or clipboard-read primitives can write the install command text itself as the key value when the user copies the command after copying the key. Fix: get a fresh key from simmer.markets/dashboard, then export SIMMER_API_KEY="sk_live_..." typed/pasted directly.`npm install -g simmer-mcp` fails with EACCES on Linux/macOS.
sudo npm install — that creates permission problems later. Either fix npm's global directory permissions per npm's docs, or just use the npx -y simmer-mcp form in your config (no global install needed; npx fetches on first launch).`claude mcp add` fails with "command not found".
mcp add subcommand. Use the JSON-write fallback under Step 4 — Claude Code.Tools work for `list_skills` but not for trading.
SIMMER_API_KEY and (for real-money venues) wallet linking. If the user wants real-money trading, they also need simmer-wallet-setup — that's a separate skill. Trading on the sim venue works without wallet setup.read -s (per SIM-2118).npx -y simmer-mcp in the config (no global install needed).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.