io.github.TradeRouter/trade-router-mcp

@traderouter/trade-router-mcp

A Model Context Protocol server for TradeRouter.ai — non-custodial Solana swap, limit, trailing, DCA, TWAP, and combo-order engine for AI agents.

Is this safe?

Yes, and here's exactly why. The private key is read once from TRADEROUTER_PRIVATE_KEY, used for local signing with @solana/web3.js + tweetnacl, and never transmitted, logged, or persisted. Only signed transactions leave your machine. Server messages are Ed25519-verified against a hard-coded trust anchor. See SECURITY.md for the full threat model, data-flow diagram, and permissions manifest.

Signing flow:

1. Agent calls build_swap → MCP sends wallet address (public key) to api.traderouter.ai
2. API returns an unsigned transaction
3. MCP signs the tx locally using TRADEROUTER_PRIVATE_KEY
4. The signed transaction is submitted to /protect (Jito MEV-protected bundle)
5. Server confirms and returns balance changes. The private key never crosses the network.

Requirements

• Node.js ≥ 18
• A Solana wallet private key in base58 format (use a dedicated trading wallet, not your main holdings)

Install

npx -y @traderouter/trade-router-mcp

Or wire it into an MCP client (Claude Desktop, Cursor, Cline, etc.):

{
  "mcpServers": {
    "traderouter": {
      "command": "npx",
      "args": ["-y", "@traderouter/trade-router-mcp"],
      "env": {
        "TRADEROUTER_PRIVATE_KEY": "your_base58_private_key"
      }
    }
  }
}

Environment variables

Tools

REST endpoints (under the hood)

Trust anchor

The baked-in server public key is EXX3nRzfDUvbjZSmxFzHDdiSYeGVP1EGr77iziFZ4Jd4. Every order_filled, order_created, and twap_execution message from the server is verified with Ed25519 before being treated as authoritative. See SECURITY.md for details and the rotation mechanism (TRADEROUTER_SERVER_PUBKEY_NEXT).

Use with LangChain

Any MCP server works in LangChain via the official adapter:

from langchain_mcp_adapters.client import MultiServerMCPClient

client = MultiServerMCPClient({
    "traderouter": {
        "command": "npx",
        "args": ["-y", "@traderouter/trade-router-mcp"],
        "transport": "stdio",
        "env": {"TRADEROUTER_PRIVATE_KEY": "<base58>"},
    },
})
tools = await client.get_tools()

Fees

Flat 1% fee on swap volume, embedded in routing at /protect. No subscription, no API key, no monthly minimums. Read-only endpoints (/holdings, /mcap) are free.

Machine-readable specs (live on traderouter.ai)

Quick SDK generation:

# TypeScript
openapi-generator-cli generate -i https://traderouter.ai/openapi.yaml -g typescript-axios -o ./sdk-ts

# Python
openapi-generator-cli generate -i https://traderouter.ai/openapi.yaml -g python -o ./sdk-py

Security disclosure

Email security@traderouter.ai or use GitHub Security Advisories on this repo. 48-hour acknowledgement. See SECURITY.md (or the hosted version if you'd rather link to a stable URL).

License

MIT. See LICENSE.

Changelog

See CHANGELOG.md.