Felix MCP
NPM · FELIX-MCP · SCANNED SEP 25
Non-custodial trading infrastructure for AI agents across prediction markets, crypto, and options.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 35 of 125 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: no source repository is declared. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 22 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability88
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 12534 tokens (~94/item across 132 items; 125 tools + 7 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management80
- Stability observed for 24 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 7 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 126 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Felix MCP server?
Felix MCP runs locally as an npm package, launched with npx -y felix-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · felix-mcp
claude mcp add trade-felix-mcp -- npx -y felix-mcp
{
"mcpServers": {
"trade-felix-mcp": {
"command": "npx",
"args": [
"-y",
"felix-mcp"
]
}
}
} {
"servers": {
"trade-felix-mcp": {
"command": "npx",
"args": [
"-y",
"felix-mcp"
]
}
}
} codex mcp add trade-felix-mcp -- npx -y felix-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"trade-felix-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"felix-mcp"
],
"enabled": true
}
}
} openclaw mcp add trade-felix-mcp --command npx --arg -y --arg felix-mcp
mcp_servers:
trade-felix-mcp:
command: "npx"
args: ["-y", "felix-mcp"] {
"McpServers": {
"trade-felix-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"felix-mcp"
]
}
}
} assistant mcp add trade-felix-mcp -t stdio -c npx -a -y felix-mcp
{
"mcpServers": {
"trade-felix-mcp": {
"command": "npx",
"args": [
"-y",
"felix-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 24 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.
- 22 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 25 Sept 2026 · Analysed npm/felix-mcp@2.0.110
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 125 packages
| Packages resolved | 125 |
|---|---|
| Stale | 35 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
route_funds ~215
Route live funds from the owner wallet to one venue. The six source_market/destination_market RFQ pairs are discoverable now but execute only after router capabilities report cross_venue_execution_ready:true. Until then they fail before moving money and direct agents to bring_home then fund_market. Felix asks approved LPs first; only owner-wallet funding may use the approved protocol fallback. The owner key signs locally.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | – | Optional owned child account UUID. |
| amount_usd | number | yes | Amount to route. |
| destination_market | string | – | Destination venue for a venue-to-venue transfer. Must differ from source_market. |
| idempotency_key | string | yes | Required RFQ and funding replay key. Reuse it after any timeout. |
| market | string | – | Destination for owner-wallet funding. Do not combine with source_market or destination_market. |
| minimum_receive_usd | number | – | Optional minimum final venue credit. |
| source_market | string | – | Source venue for a venue-to-venue transfer. |
No output schema declared.
No examples provided.
scan_options_flow ~116
Scan delayed consolidated equity-option chains for unusual volume/open-interest and premium. This is decision support, not tape-level sweep data.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Maximum rows. |
| min_premium | integer | – | Minimum chain-derived premium in USD. |
| min_vol_oi | number | – | Minimum volume/open-interest ratio. |
| min_volume | integer | – | Minimum contract volume. |
| side | string | – | Optional call or put filter. |
| symbols | array | – | Optional stock/ETF watchlist. The active tier controls the maximum. |
No output schema declared.
No examples provided.
screen_markets ~56
Screen a bounded liquid stock/crypto universe by momentum, trend, RSI, volatility, and dollar volume.
| Name | Type | Req | Description |
|---|---|---|---|
| kind | string | – | Optional stock or crypto filter. |
| limit | integer | – | Maximum rows. Defaults to 25. |
No output schema declared.
No examples provided.
search_markets ~97
Search across stocks, crypto, perps, options, and prediction markets with one fuzzy query. Use list_markets for complete venue enumeration.
| Name | Type | Req | Description |
|---|---|---|---|
| kind | string | – | Optional filter: crypto|stock|perp|option|pm. |
| limit | number | – | Max results. Defaults to 20. |
| q | string | yes | Ticker, name, or question, e.g. bitcoin, NVDA, fed rate cut. |
No output schema declared.
No examples provided.
set_exit_plan ~172
Create or replace one encrypted, server-monitored OCO exit plan on an owned Hyperliquid or Derive position.
| Name | Type | Req | Description |
|---|---|---|---|
| break_even_after_pct | number | – | Profit fraction that activates a break-even exit. |
| idempotency_key | string | yes | Required retry-safety key. |
| max_holding_minutes | number | – | Maximum position age in minutes. |
| position_id | string | yes | Owned position UUID. |
| stop_loss_pct | number | – | Loss fraction from entry, e.g. 0.05 for 5%. |
| take_profit_pct | number | – | Profit fraction from entry, e.g. 0.10 for 10%. |
| trailing_activation_pct | number | – | Profit fraction required before trailing protection arms. |
| trailing_stop_pct | number | – | Trailing distance as a decimal fraction. |
No output schema declared.
No examples provided.
settle_fees ~109
Deprecated compatibility alias for top_up_fee_balance. It adds prepaid credit; it does not settle debt and is never called by withdrawals.
| Name | Type | Req | Description |
|---|---|---|---|
| allow_low_owner_buffer | boolean | – | Explicitly allow this top-up to leave owner USDC.e below the recommended trading buffer. Preview first. |
| amount_usd | number | yes | USDC.e amount to prepay for future live execution fees. |
| idempotency_key | string | yes | Required workflow replay key. Reuse it after any timeout or restart. |
No output schema declared.
No examples provided.
start_backtest ~207
Start a durable long-running backtest and return immediately with an operation_id. Poll get_backtest_operation; API restarts can be recovered with resume_backtest_operation.
| Name | Type | Req | Description |
|---|---|---|---|
| bars | integer | – | Historical bars; interval-specific limits apply and are validated locally. |
| capital | number | – | Starting capital. |
| detail | string | – | summary (default) or full raw result. |
| idempotency_key | string | – | Optional fxbt operation key. Felix generates one when omitted. |
| interval | string | – | 1m|5m|15m|1h|4h|1d |
| markets | array | – | Optional instruments/markets, max 4. |
| name | string | – | Display name, max 80 characters. |
| strategy | object | yes | Strategy from generate_strategy, or {config:{code:'def think(ctx): ...'}}. |
| years | number | – | Historical years. Overrides bars; use interval=1d for up to 40 years. |
No output schema declared.
No examples provided.
start_bring_home ~147
Start a durable bring-home operation and return immediately with an operation_id. Use this for crypto and other routes that can take minutes; owner signing remains local and encrypted recovery state survives MCP restarts.
| Name | Type | Req | Description |
|---|---|---|---|
| allow_high_fee_loss | boolean | – | Crypto only: explicitly accept the fixed venue fee when returning less than $10. |
| amount_usd | number | – | Amount to return. Omit to sweep the full spendable prediction-market balance. |
| idempotency_key | string | yes | Required workflow replay key. Reuse it for the exact operation. |
| resume_reconciliation | boolean | – | Resume only this exact previously reconciled workflow. |
| venue | string | yes | Source market account. |
No output schema declared.
No examples provided.
start_fund_market ~160
Start durable venue funding and return immediately with an operation_id. Prefer this for crypto and options bridges; poll get_money_operation while the owner-signed route settles.
| Name | Type | Req | Description |
|---|---|---|---|
| amount_usd | number | yes | Amount to fund. |
| auto_swap_native_usdc | boolean | – | Automatically convert only the native Polygon USDC needed for this operation. Defaults to true. |
| idempotency_key | string | yes | Required workflow replay key. Reuse it for the exact operation. |
| minimum_receive_usd | number | – | Optional minimum final venue credit. The route fails closed before submission when its bounded quote cannot satisfy this floor. |
| resume_reconciliation | boolean | – | Resume only this exact previously reconciled workflow. |
| venue | string | yes | Target market account. |
No output schema declared.
No examples provided.
stop_agent ~25
Stop a caller-owned running agent.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_id | string | yes | Agent UUID. |
No output schema declared.
No examples provided.
submit_derive_onboarding ~114
Verify the owner's exact prepared Derive transactions after a browser wallet broadcasts them, or relay exact CLI-signed raw transactions.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | – | Optional owned child account UUID. |
| idempotency_key | string | – | Optional retry-safety key. Auto-generated when omitted. |
| signed_raw_transactions | array | – | Alternative CLI flow: exact 0x signed raw transactions. Never provide a private key. |
| transaction_hashes | array | – | Three 0x transaction hashes returned by a browser wallet. |
No output schema declared.
No examples provided.
submit_polymarket_withdrawal_grant ~112
Store an owner-signed, fixed-home Polymarket withdrawal grant for venue-scoped policy checks. Never accepts a private key.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | – | Optional child account UUID. |
| idempotency_key | string | – | Optional retry-safety key. Auto-generated when omitted. |
| message | string | yes | Exact message returned by prepare_polymarket_withdrawal_grant. |
| signature | string | yes | 0x-prefixed 65-byte owner personal-sign signature. |
No output schema declared.
No examples provided.
submit_wallet_policy ~105
Relay an exact owner-signed Safe V3 policy transaction. Accepts only the sealed policy token and canonical Safe signature.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | – | Optional child account UUID. |
| idempotency_key | string | – | Optional retry-safety key. Auto-generated when omitted. |
| owner_signature | string | yes | 0x-prefixed 65-byte canonical EIP-712 signature. |
| policy_token | string | yes | Opaque sealed policy intent returned by prepare_wallet_policy. |
No output schema declared.
No examples provided.
submit_withdrawal ~94
Relay an owner-signed Safe withdrawal prepared by prepare_withdrawal. Accepts only the request id and 65-byte signature, never a private key.
| Name | Type | Req | Description |
|---|---|---|---|
| idempotency_key | string | – | Optional retry-safety key. Auto-generated when omitted. |
| owner_signature | string | yes | 0x-prefixed 65-byte canonical EIP-712 signature. |
| request_id | string | yes | Prepared withdrawal UUID. |
No output schema declared.
No examples provided.
swap_native_usdc ~113
Convert Polygon native USDC into USDC.e. This is owner-signed, same-chain, may receive gas assistance, and normally happens automatically inside fund_market.
| Name | Type | Req | Description |
|---|---|---|---|
| amount_usd | number | – | Amount to swap. Defaults to the entire native USDC balance. |
| idempotency_key | string | yes | Required workflow replay key. Reuse it after any timeout or restart. |
| resume_reconciliation | boolean | – | Set true only when resuming this exact interrupted workflow after reconciling its submitted transaction hash. |
No output schema declared.
No examples provided.
test_webhook ~21
Send a sample order.filled event to active webhooks.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
top_up_fee_balance ~126
Sign one bounded USDC.e transfer locally and credit it for live execution fees. By default this refuses to consume the recommended owner-wallet trading buffer. Orders reserve exact fees before submission; no fee debt is created.
| Name | Type | Req | Description |
|---|---|---|---|
| allow_low_owner_buffer | boolean | – | Explicitly allow this top-up to leave owner USDC.e below the recommended trading buffer. Preview first. |
| amount_usd | number | yes | USDC.e amount to prepay for future live execution fees. |
| idempotency_key | string | yes | Required workflow replay key. Reuse it after any timeout or restart. |
No output schema declared.
No examples provided.
update_agent ~296
Update a stopped/paused agent's name, cadence, risk limits, or server-monitored exits in place while retaining its UUID, positions, fills, and decision history. Set resume:true to restart after the atomic update.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_id | string | yes | Agent UUID. |
| break_even_after_pct | number | – | Optional break-even activation fraction. |
| clear_exit_plan | boolean | – | Remove every server-monitored exit rule. Cannot be combined with individual exit-plan fields. |
| cycle_seconds | integer | – | Updated cadence. Polymarket minimum 5s; other venues 30s. |
| idempotency_key | string | – | Optional retry-safety key. Auto-generated when omitted. |
| max_daily_loss_usd | number | – | Updated daily realized-loss ceiling; cannot exceed agent budget or key cap. |
| max_holding_minutes | number | – | Optional maximum holding time. |
| max_position_usd | number | – | Updated per-position ceiling; cannot exceed agent budget or key cap. |
| name | string | – | Optional updated name, 1-80 characters. |
| resume | boolean | – | Restart the same agent after updating its policy. |
| stop_loss_pct | number | – | Optional live hard-stop fraction for venues with server-monitored exits. |
| take_profit_pct | number | – | Optional profit target fraction. |
| trailing_activation_pct | number | – | Optional activation fraction. |
| trailing_stop_pct | number | – | Optional trailing distance fraction. |
No output schema declared.
No examples provided.
update_wallet_policy ~141
Locally verify, sign, and relay a Safe V3 pause, resume, renewal, or emergency lockdown in one replay-safe workflow. Lockdown also revokes fixed Polymarket approvals.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | – | Optional child account UUID. |
| action | string | yes | pause|resume|renew|lockdown. |
| delegation_days | integer | – | Renewal lifetime in days. Valid only for renew; maximum 90. |
| idempotency_key | string | yes | Required durable workflow key, 1-128 printable ASCII characters. |
| resume_reconciliation | boolean | – | Set true to retry the exact signed submission after reconciling an interrupted attempt. |
No output schema declared.
No examples provided.
upgrade_subscription ~104
Buy or renew 30 days of Felix Pro for exactly $20 in native Polygon USDC. The owner signs locally, auto-renew is off, and retries reconcile the original transaction instead of paying twice.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | – | Optional owned child account UUID. |
| idempotency_key | string | yes | Required stable payment workflow key. Reuse it after any interruption. |
| plan | string | yes | Must be pro; the price is fixed server-side at $20. |
No output schema declared.
No examples provided.
use_child_account ~111
Activate a previously created child account for this session by minting and installing its owner-signed live key. After this, fund_market/place_order/etc. operate on the child. The child owner key is derived locally and never reaches Felix.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | yes | Child account UUID to activate. |
| force_remint | boolean | – | Discard any cached credential for this child and mint a fresh one. Use after the account's scopes, caps, or mandate change; otherwise the cached key is reused. |
No output schema declared.
No examples provided.
verify_custody ~47
Verify this account's Safe owner, threshold, enabled V3 module, immutable bindings, and policy against Polygon chain state.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | – | Optional owned child account UUID. |
No output schema declared.
No examples provided.
wait_for_events ~117
Long-poll durable account ledgers for agent decisions/errors and position opens/closes. One call replaces repeated polling and returns after an event or the bounded timeout.
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | ISO-8601 cursor. Omit to wait only for new events. |
| event_types | array | – | Optional event filter. |
| limit | integer | – | Maximum returned events, 1-100. Defaults to 25. |
| wait_seconds | integer | – | Maximum long-poll wait, 0-25 seconds. Defaults to 20. |
No output schema declared.
No examples provided.
wait_for_operation ~113
Wait inside one MCP call for a money or backtest operation to finish, avoiding repeated LLM polling. Returns early on completion, failure, interruption, or reconciliation-required state.
| Name | Type | Req | Description |
|---|---|---|---|
| operation_id | string | yes | fxop_ money-operation id or fxbt_ backtest-operation id. |
| poll_interval_ms | integer | – | Internal poll interval, 250-5000ms. Defaults to 1000ms. |
| wait_seconds | integer | – | Maximum wait, 1-120 seconds. Defaults to 30. |
No output schema declared.
No examples provided.
withdraw ~228
Withdraw from the funded policy Safe or owner Polygon wallet. USDC.e withdrawals deliver bridged USDC.e on Polygon; many centralized exchanges do not support it, so prefer a self-custody Polygon wallet and convert to native USDC before an exchange deposit. Felix prepares one exact intent; the local owner key signs and the result is confirmed on-chain without exposing key material.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | – | Optional owned child account UUID. |
| address | string | yes | Owner address or confirmed allowlisted Polygon destination. |
| amount | number | yes | Amount in USD/token units. |
| chain | string | – | Chain. Defaults to polygon. |
| idempotency_key | string | yes | Required durable workflow key, 1-128 printable ASCII characters. |
| resume_reconciliation | boolean | – | Set true only to retry the exact prepared request after reconciling an interrupted submit. |
| source | string | – | auto|safe|owner_wallet. auto selects the Safe when funded and otherwise the owner wallet. |
| token | string | – | USDC.e|USDC|pUSD. Defaults to USDC.e. |
No output schema declared.
No examples provided.
What is the Felix MCP server?
Felix MCP is listed in the public MCP registry as trade.felix/mcp. Non-custodial trading infrastructure for AI agents across prediction markets, crypto, and options. This page covers its npm package (felix-mcp).
Is the Felix MCP server safe to use?
Felix MCP scores 78 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 25 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Felix MCP server expose?
Felix MCP exposes 125 tools: get_status, get_health, get_metrics, get_custody_recovery_status, get_strategy_guide, and 120 more. Their descriptions and schemas cost roughly 12,375 tokens of context every time the server is loaded.
Is the Felix MCP server still maintained?
Felix MCP is still listed as active in the MCP registry. We last reached this channel on 25 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Felix MCP server under?
Felix MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.