Rate-API MCP ServerSAFE
Official MCP server for the Rate-API.com exchange-rate API: 160+ currencies, conversion, history, time series, crypto
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/@rate-api/mcp) [](LICENSE)
The official Model Context Protocol server for Rate-API.com. It gives Claude and other MCP clients exchange rates for 160+ currencies (updated hourly), currency conversion, historical rates, daily time series and fluctuation, crypto, precious-metal and end-of-day stock prices, usage and quota checks, and rate alerts.
Once connected, you can just ask: "What's 250 EUR in Japanese yen?" or "How has USD/TRY moved over the last 30 days?" and the assistant calls the API for you.
Tools
909b04cfd771OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp --env RATE_API_KEY=${RATE_API_KEY} -- npx -y @rate-api/[email protected]Exposed tools (22)
19 read · 2 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
amount | read | Amount to convert |
convert_currency | read | Convert an amount from one currency to another at the latest rate. Requires Pro plan or higher. |
create_rate_alert | write | Create a rate alert that fires (by email and optional webhook) when a pair crosses a threshold. Requires Business plan or higher. |
days | read | Look-back window in days (default 30) |
delete_rate_alert | destructive | Delete a rate alert by its id. Requires Business plan or higher. |
from | read | Source currency code |
get_api_status | write | Get Rate-API service status and rate-data freshness (currency count, last update, age). No API key required. |
get_crypto_rates | read | Get cryptocurrency prices in USD (top coins). Requires Pro plan or higher. |
get_historical_rates | read | Get exchange rates for a specific past date (YYYY-MM-DD). Requires Pro plan or higher. |
get_key_status | read | Confirm the API key works and report the API status and version. Use get_usage to see the key |
get_latest_rates | read | Get the latest exchange rates for a base currency. Returns rates for all currencies (or a filtered subset). |
get_metal_prices | read | Get precious-metal prices per troy ounce in USD: gold (XAU), silver (XAG), platinum (XPT), palladium (XPD). Requires Pro plan or higher. |
get_pair_rate | read | Get the exchange rate for a single currency pair, with optional precision. Available on all plans; the converted amount (amount/result) is included on Pro plan or higher. |
get_quota | read | Get a lean view of the plan quota and remaining requests for this API key. |
get_rate_fluctuation | read | Get how exchange rates moved between two dates (YYYY-MM-DD, range of at most 366 days): start rate, end rate, absolute change and percent change per currency. Requires Business plan or higher. |
get_stock_prices | read | Get the latest closing prices for tracked equities, in USD. End-of-day and indicative, not exchange-licensed and not for trading. Requires Pro plan or higher. |
get_timeseries_rates | read | Get daily exchange rates for every day between two dates (YYYY-MM-DD, range of at most 366 days), keyed by date. Days without published data are omitted. Pass symbols to keep the response small. Requires Business plan or higher. |
get_usage | read | Get this API key |
list_currencies | read | List all supported currencies (codes and names). |
list_rate_alerts | read | List the rate alerts configured on this API key. Requires Business plan or higher. |
pair | read | e.g. USD/TRY |
to | read | Target currency code |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (2)
delete_rate_alert
@modelcontextprotocol/sdk
Gates applied: no_behavioural_pass.
909b04cfd771full audit observations/trust-audit/mcp-server/vilgar__rate-api-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 909b04cfd771 | SAFE | B | 89 | first audit |
Questions
What is the @rate-api/mcp MCP server?
Official MCP server for the Rate-API.com exchange-rate API: 160+ currencies, conversion, history, time series, crypto
What tools does @rate-api/mcp expose?
22 in total: 19 read-only, 2 that write, and 1 that can delete or overwrite (delete_rate_alert). Every one is listed on this page with its risk.
Is @rate-api/mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does @rate-api/mcp need?
It reads RATE_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @rate-api/mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @rate-api/mcp at 1.1.1.
How current is this page?
The grade is for one exact copy of the source (909b04cfd771), read on 2026-10-11. The repository is watched and re-audited when it changes.