Atlas / MCP servers / mangrovetechnologies / mangrove-agent

mangrove-agentBLOCK

Name: mangrove-agent
Author: mangrovetechnologies

mcp/mangrovetechnologies/mangrove-agent

MCP server by mangrovetechnologies · agent marketplace · ai agent · ai guardrails · Audited 2026-10-11

⚑ Report / re-scan Source ↗

Claude agent for use with the Mangrove Developer API & MCP Server.

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

49 34r · 14w · 1d

Transport

stdio · streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

mangrove-agent

An AI trading agent built on the Mangrove API. FastAPI + MCP. Autonomous strategy generation, cron-driven execution, full audit trail. CEX trade execution on Kraken · DEX execution via 1inch across 10 EVM chains

What this is

A local AI trading agent that:

Turns natural-language goals ("momentum on ETH") into backtested, ranked trading strategies via the MangroveAI API.
Runs live strategies on APScheduler cron jobs. Same evaluator path for paper and live.
Executes live DEX swaps through MangroveMarkets — 1inch routing across 10 EVM chains (Ethereum, Base, Arbitrum, Polygon, Optimism, BNB, Avalanche, zkSync Era, Gnosis, Linea; the agent defaults to Base). Client-side signing; the routing server never touches your keys.
Trades on Kraken too, with two connection modes: **bring

Read from source at commit bbdd8d0b84bfOBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add mangrove-agent --env API_KEY=${API_KEY} --env BASE_MAINNET_PRIVATE_KEY=${BASE_MAINNET_PRIVATE_KEY} --env BASE_SEPOLIA_PRIVATE_KEY=${BASE_SEPOLIA_PRIVATE_KEY} --env KR_KEY=${KR_KEY} -- uvx mangrove-agent

claude-desktop

{
  "mcpServers": {
    "mangrove-agent": {
      "command": "uvx",
      "args": [
        "mangrove-agent"
      ],
      "env": {
        "API_KEY": "${API_KEY}",
        "BASE_MAINNET_PRIVATE_KEY": "${BASE_MAINNET_PRIVATE_KEY}",
        "BASE_SEPOLIA_PRIVATE_KEY": "${BASE_SEPOLIA_PRIVATE_KEY}",
        "KR_KEY": "${KR_KEY}"
      }
    }
  }
}

Exposed tools (49)

34 read · 14 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`agent_backtest_strategy`	write	Run a backtest against an existing strategy (mode=quick\|full).
`agent_build_strategy_from_reference`	read	Materialize a reference into an agent_create_strategy_manual payload.
`agent_create_strategy_autonomous`	write	Autonomous strategy creation: goal → candidates → backtest → rank → winner.
`agent_create_strategy_manual`	write	Manual strategy creation with explicit rules.
`agent_evaluate_strategy`	write	Manually trigger a single evaluation tick.
`agent_get_strategy`	read	Get a strategy by ID.
`agent_list_all_trades`	read	All trades across strategies.
`agent_list_evaluations`	read	Evaluation log for a strategy.
`agent_list_strategies`	read	List strategies, optionally filtered by status.
`agent_list_trades`	read	Trades for a strategy.
`agent_search_reference_strategies`	write	Search curated reference strategies — Mechanism 2 of /create-strategy.
`agent_update_strategy_status`	write	Transition strategy status. live + live→inactive require confirm=true;
`cex_balances`	read	Kraken balances (BYOK — talks to Kraken directly with the local key).
`cex_connect_kraken`	read	Connect Kraken by consuming a vault_token from scripts/stash-kraken-secret.sh.
`cex_status`	read	Is a Kraken (CEX) account connected on this machine? Free of Kraken key.
`cex_sync_fills`	write	Pull the user
`cex_validate_order`	write	Dry-run a Kraken order (validate=true) — no fill. Use before any live order.
`create_wallet`	write	Create + encrypt a wallet locally.
`execute_swap`	write	Execute a swap. Requires confirm=true + explicit slippage_pct.
`get_allowances`	read	ERC-20 allowance check — has the wallet approved `spender`?
`get_balances`	read	Token balances for a wallet via mangrovemarkets.dex.balances.
`get_dex_chart`	read	OHLC chart candles for a token pair on a DEX.
`get_gas_price`	read	Current gas price estimate for a chain.
`get_signal`	read	Server price: 0.007 USDC
`get_spot_price`	read	Current spot price for one or more tokens.
`get_swap_quote`	read	Get a DEX swap quote.
`get_token_info`	read	Look up token metadata (symbol, decimals, name) by contract address.
`get_token_search`	read	Fuzzy-search tokens by symbol or partial name.
`get_tx_status`	read	Check the status of a broadcast transaction.
`import_wallet`	write	Import an existing wallet whose secret has been stashed in the vault.
`list_dex_venues`	read	List supported DEX venues.
`list_tools`	read	List all registered MCP tools with their access tier, parameters,
`list_wallets`	read	List stored wallets (addresses + metadata only).
`local_wallet`	read	return
`marketplace_prepare`	read	Prepare a discovered Markets action for local approval without signing.
`marketplace_search`	read	Fresh server description
`marketplace_submit`	write	After user approval of the prepared action, sign locally and submit once.
`other`	write	from src.api.routes.market import market_data as route
`pay_signals_once`	write	Authorize ONE local signals read, at most 0.001 Base Sepolia test USDC.
`portfolio_defi`	read	DeFi positions (LPs, lending, staking) for one or more wallets.
`portfolio_history`	read	On-chain transaction history for a SINGLE wallet (not comma-separated).
`portfolio_pnl`	read	Running P&L across one or more wallets.
`portfolio_tokens`	read	Per-token holdings for one or more wallets.
`portfolio_value`	read	Aggregate USD value of one or more wallets.
`quote_signals`	read	Check the local MangroveAI signals price without paying or signing.
`read`	read	return backend().crypto_assets.get_market_data(symbol)
`status`	read	Return agent status: version, wallets count, strategies by status,
`x402_spend_reset`	destructive	Authorize a fresh x402 budget after the user has agreed to it.
`x402_spend_status`	read	Outbound x402 budget: spent, remaining, and what the money went on.

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	WARN
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (2 observation(s))
Network: declared (7 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: found

Findings (23)

HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427

.claude/skills/michael/knowledge-graph/SKILL.md:205

`limit` when you need the total, and never tell the user "there are ten" from a capped result.

Why it matters. asks the agent to act without the user's knowledge

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

scripts/wallet_backup.py:41

print(secret)

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

.mcp.json.example:5

"url": "http://127.0.0.1:9080/mcp/",

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

server/tests/unit/test_setup_flow.py:180

token = 'synthetic_vault_token_12345'

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

x402_spend_reset

Why it matters. 1 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

.mcp.json.example

.mcp.json.example

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319

server/tests/unit/test_payment_hardening.py:213

"file:///tmp/a", "http://localhost:invalid", "http://169.254.169.254",

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

SETUP.md:432

Done. Local agent authenticated at http://127.0.0.1:9080. Payment readiness is separate.

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/configuration.md:48

`"MANGROVEAI_BASE_URL": "http://127.0.0.1:5002/api/v1"` in the agent config and

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/mcp-contracts.md:70

python -B scripts/mcp_contract.py --upstream-url http://127.0.0.1:5002/mcp/

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/mcp-contracts.md:117

python -B scripts/mcp_contract.py --upstream-url http://127.0.0.1:5002/mcp/ --refresh-upstream