Directory / tastytrade/tastytrade-mcp

tastytrade/tastytrade-mcp

MCP server for the tastytrade open API: quotes, positions, balances, and dry-run-gated order flow for LLM agents.

Reviewed New (under 90 days old) MCP server 87/100

Not financial advice. A grade measures public repo hygiene only (license, upkeep, tests, paper mode, risk limits, docs). It does not measure returns, safety or suitability. Options trading can lose more than you invest. Read the full policy.

Reviewed. Grok Bot read the code and docs and checked or adjusted each judged factor. Nothing was executed. This is not a human audit. Reviewed on 2026-10-24 against commit 7f2bb63, rubric v1.1.

Reviewer summary: Official tastytrade MCP server. Every order goes through a dry-run confirmation gate, TASTYTRADE_READ_ONLY withholds all write tools and TASTYTRADE_ENV=sandbox selects the cert environment. It has no order size or loss limits.

Facts

Repository	https://github.com/tastytrade/tastytrade-mcp
Type	MCP server
Strategies	Not tagged
Brokers	tastytrade
License	MIT with a docs carve-out
Language	TypeScript
Last commit	2026-09-03 (51 days before the scan)
Last scanned	2026-10-24
Stars	32 (shown for context, never scored)

Score breakdown

Factor	Points	How it was decided
Risk limits and kill switch	10 / 20	No size or loss limits (the scanner's limit hits were an API endpoint name and prompt text). TASTYTRADE_READ_ONLY plus the confirmation gate earn the gate half (10). Reviewer adjusted this factor (scanner said 20). Scanner evidence (6, automated, can include false matches) `src/api-client.ts:1498` [position limit] "/position-limit", `src/mcp-server/prompts.ts:598` [max loss] ${NOT_ADVICE_DISCLAIMER} Short premium carries uncapped loss; a short strangle in particular has no maximum loss at all.`; `src/mcp-server/prompts.ts:657` [stop loss] 2. Ask the operator for: entry price, target price, stop-loss price, quantity. (Show defaults inferred from the quote where reasonable.) `server.json:79` [read-only mode] "TASTYTRADE_READ_ONLY: 1 or true withholds and refuses every write and destructive tool; 0, false, empty and unset allow them (case-insensit `src/mcp-server/prompts.ts:686` [trading enabled flag] 5. tastytrade_get_market_data for the symbol at submission time - was trading halted? `README.md:380` [human approval] - The confirmation token is not human approval. The same agent mints it and
License	15 / 15	MIT for the software. GitHub reports NOASSERTION because the LICENSE adds a carve-out for a bundled copy of tastytrade API docs, which are licensed separately. Reviewer adjusted this factor (scanner said 7). Scanner evidence (1, automated, can include false matches) `LICENSE:1` License file
Last commit on default branch	12 / 15	51 days since last commit Fact from the commit date, no judgment involved. Scanner evidence (1, automated, can include false matches) `default branch HEAD` 2026-09-03 (51 days ago)
Tests	15 / 15	2120 test cases found in 77 test files; CI test step found Reviewer confirmed the scanner result. Scanner evidence (4, automated, can include false matches) `test/api-client/injection-seam.test.ts:1` 64 test cases `test/api-client/mutation-classification.test.ts:1` 20 test cases `test/api-client/params-serializer.test.ts:1` 18 test cases `.github/workflows/ci.yml:59` # .git/config. This job runs a full `npm ci` and then a Jest battery, so
Paper or dry-run mode	15 / 15	documented and code or config switch Reviewer confirmed the scanner result. Scanner evidence (4, automated, can include false matches) `README.md:18` > For an environment with no real money in it, set `TASTYTRADE_ENV=sandbox`. `package.json:5` [dry-run flag] "description": "Model Context Protocol server for the tastytrade brokerage API: tools, resources and prompts for quotes, positions and order `server.json:76` [paper endpoint] "The endpoint defaults to PRODUCTION ([link] real accounts, real funds. TASTYTRADE_ENV=sandbox selects [link] `server.json:50` [sandbox flag] "The block above names production explicitly \u2014 real funds. Change TASTYTRADE_ENV to sandbox for no real money. An absent variable also
README quality	10 / 10	install steps, config or env vars, explains what it does, risk disclaimer, 26454 chars Reviewer confirmed the scanner result. Scanner evidence (2, automated, can include false matches) `README.md:1` README with 26454 characters `README.md:23` > about, and [Disclaimer](#disclaimer), [Disclosures](#disclosures) and
Broker detection	10 / 10	tastytrade (deps, code, readme) Reviewer confirmed the scanner result. Scanner evidence (1, automated, can include false matches) `package.json:2` [tastytrade: deps+code+readme] "name": "@tastytrade/mcp-server",
Total	87 / 100	Grades: A 85+, B 70+, C 55+, D 40+, F below.

Grades measure public repo hygiene on the scan date. They say nothing about profits, safety or security. We did not run this code. Full rubric and patterns.

Something wrong?

Report a correction Request removal (maintainers)

Corrections and removals are public GitHub issues. We reply within 7 days and every change is in the repo history. Sponsors get no special treatment: see our policy.

Badge for your README

Once the site has a public address, shields.io can read /badge/tastytrade--tastytrade-mcp.json from it. Badges show the grade and whether it was reviewed. Maintainers may use one without asking.