Model context protocol

One MCP for Poly and Stocks

Agents talk to the existing authenticated APIs — not a second domain layer. User tokens act as you. Admin tokens operate workers and Redis runtime flags. Live capital writes require confirmLive=true. The repo is still private; this surface is for operators and users who already have access.

Cursor

Remote Streamable HTTP

POST https://mcp.twentyfirst.trading/mcp with the Bearer token created below. Local stdio uses the same catalog when the MCP app can reach Poly and Stocks.

{
  "mcpServers": {
    "21trading": {
      "url": "https://mcp.twentyfirst.trading/mcp",
      "headers": {
        "Authorization": "Bearer tfmcp_…"
      }
    }
  }
}

Local stdio

{
  "mcpServers": {
    "21trading": {
      "command": "npm",
      "args": ["run", "mcp:stdio", "--workspace", "@21trading/mcp"],
      "env": {
        "MCP_TOKEN": "tfmcp_…"
      }
    }
  }
}

Scopes

User vs admin, paper vs live

User token

Tools in poly.* and stocks.* run as that account. Demo/live gates stay in the existing route handlers — same as the dashboards.

Admin token

Only if the owner email is in ADMIN_EMAIL and is not the demo user. Extra tools: workers, DB size, sampler, runtime flags, logs.

Any tool that can move live capital needs confirmLive=true. Missing flag returns a short paper-vs-live hint. The demo user can never pass this. Stripe checkout/portal, storing CLOB or Alpaca secrets, and register/login stay dashboard-only.

Catalog

Generated from existing routes

Poly (user)

Activity, markets, portfolio, analytics, paper accounts, orders, strategies (start/stop/config/lp-observe), signals, copy targets/history/lp-gate, Discover Wallets, profile/trading-context, wallets (no CLOB secrets), settings/features, worker metrics, AI conversations, terminal feeds.

Stocks (user)

Alpaca account/positions/orders (demo fixtures still apply), broker accounts, copy discover/targets/history, AI hedge fund config/runs/submit/models, Pattern Lab jobs/universe/cache/favorites, copy-status.

Ops (admin)

Workers, database size, server stats, sampler status, logs, env describe (names + comments, redacted values), runtime flags get/set, plus composed health/snapshot briefings.

Composed briefings: poly_desk_snapshot, stocks_desk_snapshot, ops_health_report. Docs live at https://trading.twentyfirst.media/mcp.

Tokens

Create a secret once. Revoke anytime.

Secrets are hashed at rest (SHA-256). Poly and Stocks settings link here. Rate limit is 60 calls per minute per token.