# io.github.tamasPetki/headless-tracker (npm · headless-tracker)

Read-only MCP server: your AI sees your crypto portfolio, never your keys. Not financial advice.

- Trust score: 76/100 (medium)
- Change this week: +30
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `headless-tracker`: 76/100 (this document), [markdown](https://verifymcp.io/servers/tamaspetki-headless-tracker/headless-tracker.md), [page](https://verifymcp.io/servers/tamaspetki-headless-tracker/headless-tracker)

## Channel facts

- Registry: `npm`
- Package: `headless-tracker`
- Version: `1.0.17`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (109 of 113), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (109 of 113), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to tamasPetki/HeadlessTracker).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 45 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 59/100
  - 60% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 6875 tokens (~404/item across 17 items; 15 tools + 2 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.
  - Supports UI / widget rendering.

## Install

### Claude

```bash
claude mcp add tamaspetki-headless-tracker -- npx -y headless-tracker
```

### Codex

```bash
codex mcp add tamaspetki-headless-tracker -- npx -y headless-tracker
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "tamaspetki-headless-tracker": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "headless-tracker"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add tamaspetki-headless-tracker --command npx --arg -y --arg headless-tracker
```

### Hermes

```yaml
mcp_servers:
  tamaspetki-headless-tracker:
    command: "npx"
    args: ["-y", "headless-tracker"]
```

### Other

```json
{
  "mcpServers": {
    "tamaspetki-headless-tracker": {
      "command": "npx",
      "args": [
        "-y",
        "headless-tracker"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 76, +4)

- [functional improvement] Stability: unverified → 0.23

### 2026-08-02 (score 72, +67)

- [security improvement] Provenance: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [security] The attested source repository moved: tamasPetki/HeadlessTracker
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → 60
- [functional improvement] MCP protocol: unverified → pass
- [functional] First check of Capabilities: pass
- [functional] Licence: MIT

### 2026-08-01 (score 5, −16)

- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 60 → unverified

### 2026-07-31 (score 21, −7)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 28, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (15)

### `get_holdings` (~544 tokens)

Returns current portfolio holdings across all connected accounts. Use this when the user asks: 'what do I own', 'show my portfolio', 'current positions', 'what's my balance', 'show my holdings', 'how much BTC do I have', or wants any snapshot of crypto/stock/prediction-market positions. For Polymarket-specific questions (which markets, outcomes, resolution or redeemable status), prefer get_polymarket_positions. For a ranked split / biggest positions, prefer get_allocations.  Each holding includes: symbol, asset class (crypto / stock / prediction / cash), quantity, current price, USD value, and connector-specific metadata (e.g. chain for EVM, market title for Polymarket, accountType for Bybit).  Inputs (all optional):   - account_id: scope to one account, e.g. 'metamask:0xabc123...' or 'bybit:UNIFIED'.     Omit to query ALL configured accounts.   - asset_class: scope to one of 'crypto' / 'stock' / 'prediction' / 'cash'.     'prediction' = Polymarket conditional tokens; 'cash' = stablecoins (USDC/USDT) + fiat. Omit for all classes.   - currency: 'USD' | 'EUR' | 'GBP' | 'HUF'. Default 'USD'. When set to anything     other than USD, value/currentPrice/avgCost are converted via live FX rates     (free API + fallback). The conversion source and fetchedAt are surfaced in     `meta.fx`. Underlying connector data is unchanged — this is a display-layer     convenience for users thinking in EUR/HUF/GBP.  Results are cached per-connector (crypto wallets 60s, exchanges 120s, Polymarket 30s). Use 'refresh_data' tool first if the user explicitly asks for fresh / latest data. Returns position data only. Not financial advice.

Input parameters:

- `account_id` (string): Scope to one account by id, e.g. 'metamask:0xabc123...' or 'bybit:UNIFIED'. Omit to query ALL configured accounts. Get valid ids from list_accounts.
- `asset_class` (string): Scope to one asset class. 'prediction' = Polymarket conditional tokens; 'cash' = stablecoin/fiat balances. Omit for all classes.
- `currency` (string): Display currency for value/currentPrice/avgCost (default 'USD'). Non-USD converts via live FX; the rate and source appear in meta.fx. Display-only — underlying data is unchanged.

### `refresh_data` (~272 tokens)

Invalidates the PORTFOLIO TRACKER cache (Bybit/Binance/MetaMask/Polymarket/Solana/Hyperliquid holdings + transactions) and forces a fresh fetch from upstream APIs on the next call. Use this when the user asks: 'refresh my portfolio', 'update my holdings', 'get the latest portfolio prices', 'fetch fresh portfolio data', 'check current crypto prices', 'my balances look stale', 'force an update', 'my data is outdated', or implies real-time freshness is required FOR THE TRACKER.  Optionally scope to a single connector (bybit, binance, metamask, polymarket, solana, hyperliquid). Without a scope, invalidates everything tracker-related.  DO NOT call this tool when the user means: refreshing a webpage, refreshing an OAuth token, refreshing browser cache, refreshing data from a non-tracker MCP server. It only invalidates the headless-tracker SQLite cache.  After calling this, follow up with get_holdings or another data tool to actually fetch the fresh data — refresh_data only marks the cache as stale, it does not trigger fetches on its own.

Input parameters:

- `connector` (string): Scope the cache invalidation to one connector. Omit to invalidate every tracker connector's cached holdings and transactions.

### `get_pnl` (~972 tokens)

Returns aggregate profit/loss across all configured accounts. Use this when the user asks: 'how am I doing', 'what's my P&L', 'am I up or down', 'show profit', 'show losses', or wants any portfolio performance summary.  Returned fields per account and across the total:   - currentValue (USD) — current portfolio value   - costBasis (USD)    — sum of avgCost * quantity (where the connector tracks it)   - unrealizedPnl (USD) — currentValue - costBasis (for positions still held)   - realizedPnl (USD)   — already-closed P&L from connector metadata   - notes               — caveats per connector (e.g. MetaMask doesn't track cost basis)  Inputs (optional):   - account_id: scope to one account.   - timeframe: '24h' | '7d' | '30d' | 'ytd' | 'all'. When set to anything other     than 'all', the result includes a `windowDelta` block computed from CoinGecko     historical prices. APPROXIMATION CAVEAT: it values your CURRENT basket at     historical prices vs current prices — it does NOT account for trades within     the window. Communicate this honestly to the user. Polymarket positions and     tokens without a CoinGecko mapping are skipped (counted in `skippedSymbols`).     CoinGecko free-tier historical is daily granularity, so '24h' = 'yesterday's close'.   - include_history (boolean, default false): also pulls transactions and runs     a cost-basis ledger over them, returning `realizedFromHistory` per     account + total. Costs an extra round-trip per account but unlocks honest     realized PnL on tokens born on-chain (LP rewards, swaps, native airdrops).     Tokens that arrived via wallet transfer-in (no price) get `unknownSalesCount`     not inflated knownRealized — explicit honesty about what cost basis we know.     POLYMARKET-SPECIFIC: when include_history=true, the Polymarket account's     realizedPnl is replaced by the cost-basis-from-/trades number. Default mode leaves     Polymarket realizedPnl null because the connector's cashPnl mixes realized     + unrealized —…

Input parameters:

- `account_id` (string): Scope to one account (e.g. 'bybit:UNIFIED'). Omit for P&L across all accounts.
- `currency` (string): Display currency for all numeric fields (default 'USD'). Non-USD converts via live FX; source/rate appear in meta.fx. Use for currency-consistent dashboards.
- `include_history` (boolean): Default false. When true, also fetches transactions and runs a cost-basis ledger for honest realizedFromHistory per account (one extra round-trip each). Required to get Polymarket's real realized P&L…
- `method` (string): Cost-basis method when include_history=true (default 'fifo'). Use 'average' if the user says 'average/avg/weighted cost'. No effect when include_history=false.
- `timeframe` (string): Default 'all'. Any non-'all' value adds a windowDelta block (current basket valued at historical vs current CoinGecko prices). APPROXIMATION: it does NOT account for trades within the window; surface…

### `get_polymarket_positions` (~435 tokens)

Returns Polymarket prediction-market positions, grouped by event when possible. Use this when the user asks about their Polymarket bets specifically:   'show my Polymarket positions', 'how am I doing on Polymarket', 'what bets do I have',   'show my prediction market positions', 'election bets', 'sports bets', etc.  For general portfolio queries that mention Polymarket alongside crypto/stocks, prefer get_holdings (with optional asset_class='prediction' filter).  Each position includes:   - market title (human-readable question, e.g. 'Will X win the 2024 election?')   - outcome ('Yes' / 'No' / specific candidate name)   - quantity (conditional tokens held, each worth 0-1 USDC)   - currentPrice (0-1, market's current implied probability)   - currentValue (USD), avgCost (USD per token), cashPnl (realized + unrealized)   - redeemable (true if market resolved and you can claim payout)   - mergeable (true if you can merge Yes+No tokens for guaranteed USDC)   - endDate (when the market resolves)  Inputs (optional):   - account_id: scope to one Polymarket account (if you have multiple).   - group_by_event: 'true' (default) groups Yes+No outcomes for the same market;     'false' returns one row per asset.   - resolved_only: 'true' returns only redeemable positions (markets that have resolved).     Default 'false' returns everything. Returns position data only. Not financial advice.

Input parameters:

- `account_id` (string): Scope to one Polymarket account if several are configured. Omit for all.
- `group_by_event` (boolean): Default true: groups Yes+No outcomes of the same market into one event row. Set false for one row per asset/outcome.
- `resolved_only` (boolean): Default false (return all positions). Set true to return only redeemable positions in markets that have already resolved.

### `get_transactions` (~384 tokens)

Returns transaction history (trades, deposits, withdrawals, fees, ERC-20 token transfers) across configured accounts. Use this when the user asks: 'what trades did I make', 'show my transactions', 'transaction history', 'recent buys', 'recent sells', 'show my deposits', 'when did I buy X', 'what did I do this week', etc.  Each transaction includes:   - type: trade / buy / sell / deposit / withdraw / fee / interest / reward / transfer / resolve   - symbol, quantity, price (per-unit at time of transaction)   - fee + feeCurrency   - timestamp (ISO 8601)   - metadata (connector-specific: chain, hash, market, etc.)  Inputs (optional):   - account_id: scope to one account.   - since: shorthand ('24h', '7d', '30d', '90d') OR epoch ms (e.g. 1700000000000).     Default: ~last 50 transactions per account regardless of date.  Coverage caveats (V0):   - Bybit: full transaction log   - MetaMask: native chain transfers + ERC-20 token transfers (USDC, USDT, etc.)   - Polymarket: BUY/SELL trades from the /trades endpoint (up to ~1000 most recent). Returns transaction data only. Not financial advice.

Input parameters:

- `account_id` (string): Scope to one account (e.g. 'metamask:0xabc...'). Omit for all accounts.
- `since` (string): Lower time bound: shorthand ('24h', '7d', '30d', '90d') or epoch milliseconds as a string (e.g. '1700000000000'). Omit for roughly the last 50 transactions per account regardless of date.

### `get_allocations` (~314 tokens)

Returns portfolio allocation breakdown — current USD value grouped by a chosen dimension. Use this when the user asks: 'how is my portfolio split', 'allocation breakdown', 'what % is in crypto', 'chain breakdown', 'show my biggest position', 'concentration'.  Groups available:   - 'asset_class' (default): crypto / stock / prediction / cash (cash = stablecoins like USDC/USDT + fiat)   - 'connector':            bybit / metamask / polymarket   - 'account':              one row per configured account   - 'chain':                EVM chain (Ethereum / Polygon / etc.) — only meaningful for MetaMask holdings   - 'symbol':               BTC / ETH / individual market — best for top-N concentration analysis  Each group row includes: label, currentValue (USD), percentOfTotal, holdingCount. Sorted descending by currentValue.  Inputs:   - by: which dimension to group by (see above). Default 'asset_class'.   - top: limit to top N rows (e.g. top: 10 for biggest positions). Default no limit. Returns position data only. Not financial advice.

Input parameters:

- `by` (string): Dimension to group USD value by (default 'asset_class'). 'chain' is only meaningful for MetaMask holdings; 'symbol' is best for top-N concentration analysis.
- `top` (integer): Limit to the top N rows by value (e.g. 10 for biggest positions). Omit for no limit.

### `list_accounts` (~246 tokens)

Lists configured PORTFOLIO TRACKER accounts (Bybit exchange / Binance exchange / MetaMask wallets / Polymarket / Solana wallets / Hyperliquid) without exposing credentials. Use when the user asks: 'what tracker accounts are configured', 'show my portfolio accounts', 'list my exchange connections', 'which crypto exchanges are linked', 'which wallets am I tracking', 'what addresses am I tracking'. Returns: id, connectorId (bybit | binance | metamask | polymarket | solana | hyperliquid), label, createdAt, and connector-specific public metadata (e.g. chainIds and addresses for MetaMask, accountType for Bybit, address for Solana/Hyperliquid, key fingerprint for Binance). Credentials are NEVER returned — they stay in the OS keychain. DO NOT call this tool when the user means: email accounts, social media accounts, GitHub accounts, cloud accounts, OS user accounts, or any 'accounts' from a different domain or MCP server. It's specifically the headless-tracker exchange/wallet connections.

Input parameters:

- `connector` (string): Filter to accounts of one connector. Omit to list every configured account.

### `setup_connector` (~816 tokens)

Creates a new account by writing READ-ONLY credentials to the OS keychain. Use when the user asks: 'add a Bybit account', 'connect Binance', 'connect my MetaMask wallet', 'set up Polymarket', 'connect my Solana wallet', 'track my Hyperliquid', 'add my Hyperliquid wallet', 'add new exchange'.  BEHAVIOR CONTRACT FOR YOU (the LLM): - After this tool succeeds, confirm ONLY the account label and account_id back to the user. - NEVER echo, log, paraphrase, or repeat the credential values (apiKey, apiSecret, etherscanApiKey) in your response. - If the user pastes credentials inline in chat, suggest they use the Settings UI (render_settings tool) form instead — the form keeps secrets out of the conversation transcript.  Credentials are validated against the upstream API before they're persisted; if validation fails, nothing is written. Storage: OS keychain (macOS Keychain / Linux Secret Service / Windows Credential Vault) via @napi-rs/keyring. Same path as the CLI setup flow.  All six connectors use READ-ONLY credentials by design (Bybit 'Read' only, Binance 'Enable Reading' only, Etherscan is a public-data rate-limit token, Polymarket proxy wallet is already public, Solana/Hyperliquid addresses are public on-chain identifiers — Hyperliquid needs no key or signature at all).  Inputs (one of bybit / binance / metamask / polymarket / solana / hyperliquid required):   - connector: 'bybit' | 'binance' | 'metamask' | 'polymarket' | 'solana' | 'hyperliquid'   - bybit: { apiKey, apiSecret, accountType: 'UNIFIED'|'CONTRACT'|'SPOT'|'FUND' (primary, also the account ID), accountTypes?: array of additional types to fan out across (e.g. ['FUND'] alongside UNIFIED so funding-wallet balances are tracked too) }   - binance: { apiKey, apiSecret, includeFutures (optional bool, default false), recvWindow (optional ms) }   - metamask: { address, etherscanApiKey, chainIds (number[]), trackCommonTokens (bool), hasEtherscanPro (bool) }   - polymarket: { proxyWallet (0x...), sizeThreshold (defaul…

Input parameters:

- `binance` (object): Binance credentials (required when connector='binance'). Read-only API key/secret.
- `bybit` (object): Bybit credentials (required when connector='bybit'). Read-only API key/secret + account type.
- `connector` (string, required): Which connector to set up. Provide the matching credential object below (e.g. connector='bybit' requires the 'bybit' object). All credentials are READ-ONLY by design.
- `hyperliquid` (object): Hyperliquid config (required when connector='hyperliquid'). Public EVM address; no key or signature.
- `metamask` (object): MetaMask/EVM config (required when connector='metamask'). Public address + Etherscan rate-limit key + chains.
- `polymarket` (object): Polymarket config (required when connector='polymarket'). Public proxy wallet address; no secret.
- `solana` (object): Solana config (required when connector='solana'). Public base58 address; no secret.

### `add_wallet_address` (~283 tokens)

Adds an additional wallet address to an existing MetaMask or Solana account. Use when the user asks: 'add another wallet', 'track a second address', 'add MetaMask address', 'add Solana address'. The new address shares the parent account's settings (Etherscan key + chains for MetaMask; RPC URL for Solana). Wallet addresses are public on-chain identifiers — NO new secrets are stored. Just updates the keychain entry's `addresses[]` field. Inputs:   - account_id: id of the existing account (e.g. 'metamask:0xabc...' or 'solana:Abc...')   - address: EVM 0x-hex address (40 hex chars) for MetaMask accounts, or base58 (32-44 chars) for Solana accounts

Input parameters:

- `account_id` (string, required): Id of the existing MetaMask or Solana account to add the address to (e.g. 'metamask:0xabc...' or 'solana:Abc...'). The new address inherits the parent's settings.
- `address` (string, required): The wallet address to add: an EVM 0x-hex address (40 hex chars) for MetaMask accounts, or a base58 address (32-44 chars) for Solana accounts. Public on-chain identifier, no secret.

### `remove_account` (~168 tokens)

Deletes an account from the AccountStore AND its credentials from the OS keychain. ONE-WAY operation. The Settings UI requires explicit user confirmation before calling this. Use when the user asks: 'remove the Bybit account', 'disconnect Polymarket', 'forget that wallet'. Inputs:   - account_id: id of the account to remove (e.g. 'bybit:UNIFIED', 'metamask:0xabc...'). Returns: ok, removedAccountId; or error if the account was not found.

Input parameters:

- `account_id` (string, required): Id of the account to delete (e.g. 'bybit:UNIFIED', 'metamask:0xabc...'). ONE-WAY: removes the account and its keychain credentials. Confirm with the user first.

### `add_custom_token` (~374 tokens)

Adds a project-specific ERC-20 token to a MetaMask account's tracked-tokens list. The bundled common tokens (USDC, USDT, WETH, WBTC, LINK, DAI) are tracked by default; this is for additional tokens like project / governance tokens. Use when the user asks: 'track ARB token', 'add UNI to my wallet', 'monitor a custom ERC-20'. Token data is PUBLIC on-chain (contract + symbol + decimals) — NO secrets, NO keychain involved. Inputs:   - account_id: target MetaMask account (e.g. 'metamask:0xabc...')   - chain_id: numeric (1=Ethereum, 137=Polygon, 56=BSC, 8453=Base, 42161=Arbitrum, 10=Optimism)   - contract: 0x-prefixed contract address (40 hex)   - symbol: 1-20 chars   - decimals: 0-36 integer

Input parameters:

- `account_id` (string, required): Target MetaMask account id (e.g. 'metamask:0xabc...').
- `chain_id` (integer, required): EVM chain id: 1=Ethereum, 137=Polygon, 56=BSC, 8453=Base, 42161=Arbitrum, 10=Optimism.
- `contract` (string, required): ERC-20 contract address: 0x-prefixed, 40 hex chars. Public on-chain data, no secret.
- `decimals` (integer, required): Token decimals (integer 0-36; most ERC-20s use 18, USDC/USDT use 6).
- `symbol` (string, required): Token ticker symbol, 1-20 chars (e.g. 'ARB').

### `remove_custom_token` (~267 tokens)

Removes a custom ERC-20 token from a MetaMask account's tracked-tokens list. Public on-chain data, no keychain involvement. Use when the user asks: 'stop tracking ARB', 'remove that token from MetaMask', 'untrack a project token'. Inputs:   - account_id: target MetaMask account (e.g. 'metamask:0xabc...')   - chain_id: numeric (1=Ethereum, 137=Polygon, 56=BSC, 8453=Base, 42161=Arbitrum, 10=Optimism)   - contract: 0x-prefixed contract address (40 hex) Returns ok or a not_found error if the token wasn't tracked under that account+chain.

Input parameters:

- `account_id` (string, required): Target MetaMask account id (e.g. 'metamask:0xabc...').
- `chain_id` (integer, required): EVM chain id the token is tracked on: 1=Ethereum, 137=Polygon, 56=BSC, 8453=Base, 42161=Arbitrum, 10=Optimism.
- `contract` (string, required): ERC-20 contract address to untrack: 0x-prefixed, 40 hex chars.

### `list_custom_tokens` (~85 tokens)

Lists custom ERC-20 tokens tracked by MetaMask accounts. Public data; no secrets involved. Use when the user asks: 'which custom tokens am I tracking', 'show my project tokens'. Inputs (optional): account_id to filter to one account.

Input parameters:

- `account_id` (string): Filter to one MetaMask account id. Omit to list custom tokens across all accounts.

### `render_dashboard` (~358 tokens)

Portfolio Dashboard

Render an interactive PORTFOLIO TRACKER dashboard as an MCP App (live UI panel) — for crypto holdings, P&L, prediction markets, on-chain wallets. Use this when the user asks: 'show my portfolio dashboard', 'open my dashboard', 'render the portfolio panel', or wants a live interactive view of holdings / weekly portfolio review / risk audit. Three tabs (Portfolio / Weekly / Risk) with currency switcher (USD/EUR/GBP/HUF) and refresh button. The iframe makes its own tool calls (get_holdings / get_pnl / get_allocations / get_transactions / get_polymarket_positions / refresh_data) as the user clicks tabs and refresh — no extra prompting from you needed once it's open. If the host doesn't render MCP Apps, the tool still returns a textual confirmation but the user won't get the live UI.  DO NOT call this tool when the user means a different kind of dashboard (Vercel deploys, Sentry errors, Grafana metrics, GitHub activity, analytics events, etc.). It's specifically the headless-tracker portfolio dashboard. If the request is ambiguous, ask the user to clarify which dashboard they mean.  Inputs (both optional):   - currency: 'USD' | 'EUR' | 'GBP' | 'HUF'. Initial display currency. User can switch live.   - tab: 'portfolio' | 'weekly' | 'risk'. Initial active tab. User can switch live.

Input parameters:

- `currency` (string): Initial display currency for the dashboard (default 'USD'). The user can switch it live in the panel.
- `tab` (string): Initial active tab (default 'portfolio'). The user can switch tabs live in the panel.

### `render_settings` (~404 tokens)

Settings

Render the PORTFOLIO TRACKER Settings panel as an MCP App (live UI panel) — the GUI alternative to the CLI setup flow for headless-tracker (Bybit / MetaMask / Polymarket connections). Use when the user asks: 'open my portfolio settings', 'add a Bybit account', 'connect my MetaMask wallet to the tracker', 'show my tracker accounts', 'remove this exchange connection', 'add a custom ERC-20 token', 'add another wallet address to track'. Four tabs:   - Accounts: read-only list of configured tracker accounts with Remove buttons (one-way confirm dialog).   - Add Account: forms for Bybit / MetaMask / Polymarket with explicit security disclosure.   - Wallets: add an additional wallet address to an existing MetaMask tracker account.   - Custom Tokens: list + add/remove ERC-20 tokens per chain.  DO NOT call this tool when the user means: app settings (Claude Desktop / VS Code / browser), system preferences, OS settings, account settings on websites, profile settings, notification settings, theme/appearance, or any settings UI from a different MCP server. It's specifically the headless-tracker portfolio-tracker setup panel. If the request is ambiguous (just 'open settings'), ask which settings.  BEHAVIOR CONTRACT FOR YOU (the LLM): If the user pastes credentials directly in chat, prefer pointing them at this Settings UI rather than calling setup_connector with the inline values — the form keeps secrets out of the conversation transcript. After the user uses the form, the tool result is cosmetic confirmation; do NOT echo or paraphrase any credential values that may appear in the conversation.  Inputs (optional):   - tab: 'accounts' | 'add-account' | 'wallets' | 'tokens' — initial active tab.

Input parameters:

- `tab` (string): Initial active tab (default 'accounts'). The user can switch tabs live in the panel.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/tamaspetki-headless-tracker/headless-tracker#diagnostics

## Score history

- 2026-08-03: 76
- 2026-08-02: 72
- 2026-08-01: 5
- 2026-07-31: 21
- 2026-07-30: 28
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/headless-tracker
- Socket report: https://socket.dev/npm/package/headless-tracker
- Repository: https://github.com/tamasPetki/HeadlessTracker
- Changelog RSS feed: https://verifymcp.io/servers/tamaspetki-headless-tracker/headless-tracker/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/tamaspetki-headless-tracker/headless-tracker/changelog.json
- HTML version of this page: https://verifymcp.io/servers/tamaspetki-headless-tracker/headless-tracker