eToro MCP Server (Security-Hardened Fork)

Originally created by orkblutt — full credit to the original author. This is a security-hardened fork. See SECURITY.md for all changes made. Original repo: https://github.com/orkblutt/etoro-mcp

---

MCP server that wraps the eToro public API, exposing 34 tools for AI assistants (Claude Desktop, Cursor, Claude Code, etc.).

Security Improvements Over Original

This fork fixes 9 security issues found in the original:

• 🔴 API key headers were swapped (x-api-key ↔ x-user-key)
• 🔴 Usernames injected into URLs without encodeURIComponent
• 🟠 Missing credentials only warned — now hard-fails at startup
• 🟠 No rate limiting — token-bucket limiter added for trading & readonly ops
• 🟠 No content limits on social posting — now capped at 1000/500 chars
• 🟡 Raw eToro API error bodies leaked to LLM — now sanitized
• 🟡 get_closing_prices fetched all instruments — now requires explicit IDs
• 🟡 No live-mode warnings on trading tools — now logs prominently
• 🟡 Missing Zod input validation (min/max/int/positive) across all tools

Full details in SECURITY.md.

---

What Can You Do With It?

Below are real conversations with an AI assistant connected to the eToro MCP server.

Place a limit order

You: Place a buy limit order for 5 SOL if it reaches $75

Assistant: Current SOL price is $78.21. I've placed a buy limit order for 5 SOL at $75 ($375 total) with a stop loss at $1. Order confirmed.

DCA ladder based on technical analysis

You: Can you place some DCA buy limit orders for ETH based on key support levels?

Assistant: Based on the chart, here are the key support levels for ETH:

• $1,750 — first support zone
• $1,500 — strong horizontal support
• $1,200 — macro support
• $1,000 — psychological floor

I've placed 4 limit orders across those levels.

Portfolio analysis

You: What's my average entry price on SOL including all my positions?

Assistant: You have 27 SOL positions totaling 124.62 SOL with an average entry of $120.99.

Market research

You: What do you think about SUI?

Assistant: SUI is trading at $0.905, down 75% from its October high of $3.70. Your 4 positions total 3,434 SUI at an average of $1.18 — currently -23%.

---

Setup

1. Build

npm install
npm run build

2. Configure credentials

You need an eToro API key and user key.

Option A: Environment variables (recommended)

export ETORO_API_KEY=your-api-key
export ETORO_USER_KEY=your-user-key
export ETORO_TRADING_MODE=demo   # use "real" for live trading
node dist/index.js

Option B: Claude Desktop (claude_desktop_config.json)

{
  "mcpServers": {
    "etoro-mcp": {
      "command": "node",
      "args": ["/path/to/etoro-mcp/dist/index.js"],
      "env": {
        "ETORO_API_KEY": "your-api-key",
        "ETORO_USER_KEY": "your-user-key",
        "ETORO_TRADING_MODE": "demo"
      }
    }
  }
}

Option C: CLI arguments

node dist/index.js --api-key your-api-key --user-key your-user-key --trading-mode demo

⚠️ Note: The server will refuse to start if ETORO_API_KEY or ETORO_USER_KEY are missing.

3. Restart the MCP server

After changing config, restart the server or the Claude Desktop app.

---

Configuration

Setting	Env var	CLI arg	Default
API Key	ETORO_API_KEY	--api-key	(required)
User Key	ETORO_USER_KEY	--user-key	(required)
Trading Mode	ETORO_TRADING_MODE	--trading-mode	demo

Trading mode: demo routes trading calls through eToro's demo/virtual account. Set to real for live trading. A prominent warning is logged when live mode is active.

---

Rate Limiting

This fork adds a token-bucket rate limiter to protect your account from unintended burst activity in agentic loops:

Bucket	Tools	Burst	Refill
trading	Order placement, social posting, watchlist writes	5 requests	1 req/sec
readonly	Market data, portfolio reads, user lookups	20 requests	5 req/sec

---

Tools (34 total)

Market Data (8)

Tool	Description
search_instruments	Search instruments by keyword
get_instruments	Get instrument details by IDs (max 100)
get_instrument_types	List all instrument types
get_industries	List industry classifications
get_exchanges	List stock exchanges
get_candles	Get OHLCV candle data
get_closing_prices	Get closing prices for specified instruments
get_rates	Get live bid/ask rates

Trading (7)

Tool	Description
open_position_by_amount	Open position by USD amount
open_position_by_units	Open position by unit count
close_position	Close an open position
place_limit_order	Place a limit/entry order
cancel_order	Cancel a pending order
get_orders	List all pending orders
get_portfolio	Get all open positions

Social Feeds (4)

Tool	Description
get_instrument_feed	Get social feed for an instrument
get_user_feed	Get social feed for a user
create_post	Create a post (max 1000 chars)
create_comment	Comment on a post (max 500 chars)

Watchlists (9)

Tool	Description
get_watchlists	List your watchlists
create_watchlist	Create a watchlist
delete_watchlist	Delete a watchlist
rename_watchlist	Rename a watchlist
add_watchlist_items	Add instruments to a watchlist (max 50)
remove_watchlist_item	Remove an instrument from a watchlist
set_default_watchlist	Set default watchlist
get_curated_lists	Get eToro's curated lists
get_public_watchlists	Browse public watchlists

User & Discovery (6)

Tool	Description
get_user_profile	Get a user's public profile
get_user_performance	Get performance summary
get_user_performance_granular	Get detailed performance over a period
get_user_trades	Get trade history
get_user_portfolio	Get public portfolio holdings
discover_users	Discover popular investors

---

Credits

• Original author: orkblutt — https://github.com/orkblutt/etoro-mcp
• Security audit & fixes: Vipul Ranjan
• License: MIT (see LICENSE)