hkuds/vibe-trading

English | 中文 | 日本語 | 한국어 | العربية

Vibe-Trading: Your Personal Trading Agent

One Command to Empower Your Agent with Comprehensive Trading Capabilities

Website  ·  Docs  ·  News  ·  Features  ·  Shadow Account  ·  Demo  ·  Quick Start  ·  Examples  ·  API / MCP  ·  Roadmap  ·  Contributing

---

📰 News

⚠️ Security warning: The X account VibeTrading_HKU, Virtuals project 101845, and token contract 0x640BDBF77b6447E8b7DB7894cED84BD1c40571f4 are not official Vibe-Trading assets. We have never launched or endorsed any token or memecoin. Do not buy, connect a wallet, or sign anything. Details.

• 2026-07-14 🌉 Longbridge market data + modern MCP transport + provider reliability: Longbridge joins the historical-data fallback layer with key-gated credentials, date-window splitting, strict completeness checks, and an opt-in SDK dependency; four China-market flow tools gain verified Tushare fallbacks, and negative final equity no longer crashes backtest metrics. The MCP server now supports Streamable HTTP, write_file safely recovers aliased or missing path arguments, hypothesis updates reject unsupported fields, and Correlation requests are authenticated. NVIDIA NIM is now a first-class provider across Web Settings and both CLI onboarding paths, with a versioned compatibility User-Agent to address the reported 403; Web Settings now writes to the canonical ~/.vibe-trading/.env, migrates legacy configuration, and reports permission failures clearly, fixing the DeepSeek save-time 500 (#534, closes #516/#524; #528/#529). Thanks @fanfpy, @asahikiko, @santhreal, @sTunnaSu, @abhishekjaisinghani, @huangcheng, @ShiroKSH, @Meru143, @DIEGOD79, and @not-knope for the code, reports, and diagnosis.

• 2026-07-13 🔒 Security hardening: all 10 external-audit findings closed + contributor batch: every finding from the 2026-07-10 external security audit (issue #476, discussion #468) is now addressed on main — Docker multi-stage rebuild with digest-pinned images, an AST-hardened backtest sandbox blocking network/subprocess/eval/os.environ/unsafe-open (including inside nested function bodies), short-lived single-use SSE auth tickets, hardened Compose (read-only rootfs, dropped capabilities, resource limits), auth + rate limiting on /correlation, security headers, hash-locked dependencies, and more. Also merged: opt-in TAP mode for Alpaca key isolation (#377, thanks @0xZKnw), realized portfolio turnover surfaced in backtest metrics (#478, thanks @Robin1987China), a Frazzini-Pedersen betting-against-beta academic factor (Alpha Zoo → 461, #480, thanks @YogeshModi24), a look-ahead-bias fix across all 5 portfolio optimizers (#487, thanks @YZY0108), and two preflight/provider-config fixes (#479/#484, closes #477/#482, thanks @ananaymital/@Bortlesboat).

• 2026-07-12 🧪 Strategy Development Manager + contributor fix batch: the new strategy-dev-manager skill (#87) turns academic papers and broker research into registered factors/strategies with a persistent artifact store and automated IC/Sharpe decay monitoring — sdm_register / sdm_status / sdm_decay_scan drive an active → monitoring → decayed → disabled lifecycle over ~/.vibe-trading/ (#457, closes #455, thanks @shadowinlife). Also merged: the Correlation tab accepts bare tickers (AAPL,SPY) and walks the full loader fallback chain (#472, closes #471, thanks @yxhuang), the local loader honors requested intervals via OHLCV resampling (#467, thanks @Shizoqua), Binance USD-M perpetual history lands with explicit BTC-USDT-PERP routing + execution/mark price separation as the first #462 slice (#470, thanks @honginp), FastMCP transport imports now work across both module layouts (#469, thanks @roberttidball), and Requesty is available as an OpenAI-compatible LLM gateway provider (#474, thanks @Thibaultjaigu).

---

✨ Key Features

  🐝 Multi-Agent Trading Teams
  




  
  📊 Cross-Market Data & Backtesting
  


  
  👥 Shadow Account

💡 What Is Vibe-Trading?

Vibe-Trading is an open-source research workspace for turning finance questions into runnable analysis. It connects natural-language prompts to market-data loaders, strategy generation, backtest engines, reports, exports, and persistent research memory.

It is designed for research, simulation, and backtesting — and, when you choose, autonomous trading through a broker you authorize yourself (e.g. Robinhood Agentic Trading). It holds no funds and never trades outside the limits you set, and you can halt it instantly.

---

✨ What You Can Do

---

⚡ Quick Example

pip install vibe-trading-ai

# Natural-language research
vibe-trading run -p "Backtest a BTC-USDT 20/50 moving-average strategy for 2024, summarize return and drawdown, then export the report"

# Bench a pre-built alpha zoo (one line)
vibe-trading alpha bench --zoo gtja191 --universe csi300 --period 2018-2025 --top 20

vibe-trading --upload trades_export.csv
vibe-trading run -p "Analyze my trading behavior, extract my shadow strategy, and compare it with my actual trades"

---

👥 Shadow Account

Shadow Account starts from your own trading records instead of a generic strategy template.

Upload a broker export, let the agent summarize your behavior, then compare the actual trading path with a rule-based shadow strategy.

vibe-trading --upload trades_export.csv
vibe-trading run -p "Analyze my trading behavior, extract my shadow strategy, and compare it with my actual trades"

---

🧪 Research Workflow

Most runs follow the same evidence path: route the request, load the right market context, execute tools, validate outputs, and keep the artifacts inspectable.

---

📡 Data Sources & Smart Fallback

One get_market_data call, 19 free market-data sources (plus the optional QVeris premium marketplace). Set source: "auto" — the loader picks by symbol, then walks a per-market chain ordered by IP-ban risk: never-banned public sources first, throttled / key-gated ones last. Zero config, no single point of failure.

Fallback chains (by IP-ban risk):

• A-share → tencent · mootdx · eastmoney · baostock · akshare · tushare · local
• US → yahoo · stooq · sina · eastmoney · yfinance · tiingo · fmp · finnhub · alphavantage · akshare · local
• HK → eastmoney · yahoo · futu · yfinance · akshare · local
• India (NSE/BSE) → yahoo · yfinance · india_broker · local
• Crypto → okx · ccxt · yfinance · local  ·  (futures / fund / macro / forex → tushare/akshare → local)

Beyond OHLCV, 18 read-only data tools reach into fundamentals & flow — fund flow, dragon-tiger, northbound, margin, block trades, shareholder count, lockup, sector, research reports, news, SEC filings, financial statements, options chains, institutional holdings, market screening, symbol search, and macro — all exposed over MCP. An explicit local: symbol never silently falls back to a network source.

💎 Optional premium data — QVeris

Data: free routing or premium, your choice. Free stays the default: 19 built-in sources with ban-risk fallback, no key, no cost. Premium via QVeris adds 10,000+ capabilities (per QVeris) across 63+ providers for options Greeks, premium fundamentals, China/HK/global data, macro, crypto, news, and filings; failed calls are not charged. Enable it in Settings -> QVeris or vibe-trading data mode paid.

QVeris disclosure: signing up through the Vibe-Trading referral link gets you +1,000 bonus credits and supports the project.

---

🔩 Detailed Capabilities

Detailed inventories are folded below to keep the main README scannable. Open them when you want to inspect the available building blocks.

🎬 Demo

---

🚀 Quick Start

One-line install (PyPI)

pip install vibe-trading-ai

Then run a first research task:

vibe-trading init
vibe-trading run -p "Backtest a BTC-USDT 20/50 moving-average strategy for 2024 and summarize return and drawdown"

Upgrading from an older version? 0.1.10 moved to LangChain 1.x. If imports break after pip install -U vibe-trading-ai over a pre-0.1.10 install (e.g. langgraph fails to import), recreate the venv or run pip install --force-reinstall vibe-trading-ai. A fresh install is unaffected.

Package name vs commands: The PyPI package is vibe-trading-ai. Once installed, you get three commands:

Command	Purpose
vibe-trading	Interactive CLI / TUI
vibe-trading serve	Launch FastAPI web server
vibe-trading-mcp	Start MCP server (for Claude Desktop, OpenClaw, Cursor, etc.)

vibe-trading init              # interactive .env setup
vibe-trading                   # launch CLI
vibe-trading serve --port 8899 # launch web UI
vibe-trading-mcp               # start MCP server (stdio)

Or choose a path

Prerequisites

• An LLM API key from any supported provider — or run locally with Ollama (no key needed)
• Python 3.11+ for Path B
• Docker for Path A
• OpenAI Codex can also be used with ChatGPT OAuth: set LANGCHAIN_PROVIDER=openai-codex, then run vibe-trading provider login openai-codex. This does not use OPENAI_API_KEY.

Supported LLM providers: OpenRouter, Requesty, OpenAI, DeepSeek, Gemini, Groq, DashScope/Qwen, Zhipu, Moonshot/Kimi, MiniMax, Xiaomi MIMO, Z.ai, Ollama (local). See .env.example for config.

Tip: All markets work without any API keys thanks to automatic fallback. yfinance (HK/US), OKX (crypto), mootdx (A-shares, TCP-direct, no IP throttle), and AKShare (A-shares, US, HK, futures, forex) are all free. Tushare token is optional — mootdx is the preferred no-token A-share fallback, with AKShare as a broader backup.

Path A: Docker (zero setup)

git clone https://github.com/HKUDS/Vibe-Trading.git
cd Vibe-Trading
cp agent/.env.example agent/.env
# Edit agent/.env — uncomment your LLM provider and set API key
docker compose up --build

Open http://localhost:8899. Backend + frontend in one container.

Docker publishes the backend on 127.0.0.1:8899 by default and runs the app as a non-root container user. If you intentionally expose the API beyond your own machine, set a strong API_AUTH_KEY and send Authorization: Bearer from clients.

[!NOTE] Using Ollama with Docker: the container reaches a host-side Ollama via host.docker.internal, not localhost (inside the container localhost is the container itself). docker-compose.yml defaults OLLAMA_BASE_URL to http://host.docker.internal:11434; export OLLAMA_BASE_URL (or set it in a top-level .env) to point elsewhere. This relies on the host-gateway mapping in extra_hosts, which requires Docker Engine ≥ 20.10 / Compose v2 (provided automatically on Docker Desktop).

Your data survives updates: persistent memory, the cross-session search index, user-created skills, shadow accounts, broker connector config, web sessions, backtest runs, swarm history, and uploads all live in named Docker volumes, so git pull && docker compose up --build keeps them. They are deleted only by docker compose down -v.

Path B: Local install

git clone https://github.com/HKUDS/Vibe-Trading.git
cd Vibe-Trading
python -m venv .venv

# Activate
source .venv/bin/activate          # Linux / macOS
# .venv\Scripts\Activate.ps1       # Windows PowerShell

pip install -e .
cp agent/.env.example agent/.env   # Edit — set your LLM provider API key
vibe-trading                       # Launch interactive TUI

Path C: MCP plugin

See MCP Plugin section below.

Path D: ClawHub (one command)

npx clawhub@latest install vibe-trading --force

The skill + MCP config is downloaded into your agent’s skills directory. See ClawHub install for details.

---

🧠 Environment Variables

Copy agent/.env.example to agent/.env and uncomment the provider block you want. Each provider needs 3-4 variables:

• Ollama does not require an API key. OpenAI Codex uses ChatGPT OAuth and stores tokens via oauth-cli-kit, not in agent/.env.

Free data (no key needed): A-shares via AKShare, HK/US equities via yfinance, crypto via OKX, 100+ crypto exchanges via CCXT. The system automatically selects the best available source for each market.

🎯 Recommended Models

Vibe-Trading is a tool-heavy agent — skills, backtests, memory, and swarms all flow through tool calls. Model choice directly decides whether the agent uses its tools or fabricates answers from training data.

The default agent/.env.example ships with DeepSeek official API + deepseek-v4-pro; OpenRouter users can use deepseek/deepseek-v4-pro.

---

🖥 CLI Reference

The interactive TUI (vibe-trading) now uses a terminal-native transcript: a startup banner, prompt rule, previous-turn recap, live activity rail, Markdown/table rendering, and run timing all stay in the CLI. Non-interactive invocations such as vibe-trading run, pipes, and --json remain script-friendly.

vibe-trading               # interactive TUI
vibe-trading run -p "..."  # single run
vibe-trading serve         # API server
vibe-trading alpha list    # browse 461 pre-built alphas; show / bench / compare / export-manifest sub-commands available
vibe-trading channels status --local  # inspect IM channel config and install hints
vibe-trading provider doctor  # print redacted provider/proxy/package diagnostics

---

💡 Examples

Strategy & Backtesting

# Moving average crossover on US equities
vibe-trading run -p "Backtest a 20/50-day moving average crossover on AAPL for the past year, show Sharpe ratio and max drawdown"

# RSI mean-reversion on crypto
vibe-trading run -p "Test RSI(14) mean-reversion on BTC-USDT: buy below 30, sell above 70, last 6 months"

# Multi-factor strategy on A-shares
vibe-trading run -p "Backtest a momentum + value + quality multi-factor strategy on CSI 300 constituents over 2 years"

# After backtesting, export to TradingView / TDX / MetaTrader 5
vibe-trading --pine 

Bench a pre-built alpha zoo (one line):

vibe-trading alpha bench --zoo gtja191 --universe csi300 --period 2018-2025 --top 20

Browse the catalogue and inspect a single alpha:

vibe-trading alpha list --zoo gtja191 --theme reversal --limit 10
vibe-trading alpha show gtja191_171

Compose a multi-factor signal from the zoo (Python):

from src.skills.multi_factor.zoo_signal_engine import ZooSignalEngine
engine = ZooSignalEngine.from_zoo(["gtja191_171", "gtja191_111", "gtja191_163"])
panel = ...  # your wide OHLCV panel
signal = engine.compute_signal(panel)

Market Research

# Equity deep-dive
vibe-trading run -p "Research NVDA: earnings trend, analyst consensus, option flow, and key risks for next quarter"

# Macro analysis
vibe-trading run -p "Analyze the current Fed rate path, USD strength, and impact on EM equities and gold"

# Crypto on-chain
vibe-trading run -p "Deep dive BTC on-chain: whale flows, exchange balances, miner activity, and funding rates"

Swarm Workflows

# Bull/bear debate on a stock
vibe-trading --swarm-run investment_committee '{"topic": "Is TSLA a buy at current levels?"}'

# Quant strategy from screening to backtest
vibe-trading --swarm-run quant_strategy_desk '{"universe": "S&P 500", "horizon": "3 months"}'

# Crypto desk: funding + liquidation + flow → risk manager
vibe-trading --swarm-run crypto_trading_desk '{"asset": "ETH-USDT", "timeframe": "1w"}'

# Global macro portfolio allocation
vibe-trading --swarm-run macro_rates_fx_desk '{"focus": "Fed pivot impact on EM bonds"}'

Cross-Session Memory

# Save your preferences once
vibe-trading run -p "Remember: I prefer RSI-based strategies, max 10% drawdown, hold period 5–20 days"

# The agent recalls them in future sessions automatically
vibe-trading run -p "Build a crypto strategy that fits my risk profile"

Upload & Analyze Documents

# Analyze a broker export or earnings report
vibe-trading --upload trades_export.csv
vibe-trading run -p "Profile my trading behavior and identify any biases"

vibe-trading --upload NVDA_Q1_earnings.pdf
vibe-trading run -p "Summarize the key risks and beats/misses from this earnings report"

---

🌐 API Server

vibe-trading serve --port 8899

Interactive docs: http://localhost:8899/docs

Security defaults

For localhost development, vibe-trading serve keeps the browser workflow simple. For any non-local client, sensitive API endpoints require API_AUTH_KEY; use Authorization: Bearer for JSON/upload requests. Browser EventSource streams are handled by the Web UI after you enter the same key once in Settings.

Shell-capable tools are available to local CLI and trusted localhost workflows, but are not exposed to remote API sessions unless you explicitly set VIBE_TRADING_ENABLE_SHELL_TOOLS=1. Document and journal readers are limited to upload/import roots by default; place files under agent/uploads, agent/runs, ./uploads, ./data, ~/.vibe-trading/uploads, or ~/.vibe-trading/imports, or add a dedicated directory through VIBE_TRADING_ALLOWED_FILE_ROOTS.

Generated backtest code runs as a local Python subprocess and can make network requests through the configured market-data loaders. Its environment is intentionally narrow: the runner keeps OS/Python basics, proxy/certificate settings, VIBE_TRADING_ALLOWED_RUN_ROOTS, and read-only market-data keys such as TUSHARE_TOKEN, FMP_API_KEY, FRED_API_KEY, and VIBE_TRADING_IWENCAI_KEY. It does not pass LLM provider keys, API auth tokens, shell-tool switches, broker trading secrets, or live/advisory toggles to generated strategy code by default.

Web UI Settings

The Web UI Settings page lets local users update the LLM provider/model, base URL, generation parameters, reasoning effort, and optional market data credentials such as the Tushare token. Settings are persisted to agent/.env; provider defaults are loaded from agent/src/providers/llm_providers.json.

Settings reads are side-effect free: GET /settings/llm and GET /settings/data-sources never create agent/.env, and they only return project-relative paths. Settings reads and writes can expose credential state or update credentials/runtime environment, so they require API_AUTH_KEY when configured. If API_AUTH_KEY is unset for dev mode, settings access is accepted only from loopback clients.

The same Settings page includes an IM Channels panel for local operators. It polls /channels/status, shows configured/enabled/available/loaded/running states, surfaces adapter recovery hints, and can start or stop the configured channel runtime without going back to the terminal.

Scheduled research

Run a research prompt or backtest on a repeating schedule. The background executor is off by default — start the server with VIBE_TRADING_ENABLE_SCHEDULER=1 to enable it:

VIBE_TRADING_ENABLE_SCHEDULER=1 vibe-trading serve --port 8899

Then create jobs over REST. schedule is either a bare integer (interval in milliseconds) or a 5-field cron expression (min hour dom mon dow):

# every 6 hours (cron)
curl -X POST http://localhost:8899/scheduled-runs \
  -H "Content-Type: application/json" \
  -d '{"prompt":"Scan CSI300 for momentum breakouts and backtest the top 5","schedule":"0 */6 * * *"}'

# list / cancel
curl http://localhost:8899/scheduled-runs
curl -X DELETE http://localhost:8899/scheduled-runs/

Each fire runs the prompt through a fresh agent session (optional backtest parameters go in config), and jobs persist under ~/.vibe-trading/ so they survive restarts. Without the flag, the /scheduled-runs endpoints still record jobs but nothing fires. Add -H "Authorization: Bearer " to each call when API_AUTH_KEY is set.

---

🔌 MCP Plugin

Vibe-Trading exposes 54 MCP tools for any MCP-compatible client. Runs as a stdio subprocess — no server setup needed. Core research tools work with zero API keys for HK/US/crypto; trading connector tools use the selected connector profile, and run_swarm needs an LLM key.

MCP tools exposed (54): list_skills, load_skill, start_research_goal, get_research_goal, add_goal_evidence, update_research_goal_status, backtest, factor_analysis, analyze_options, pattern_recognition, read_url, read_document, web_search, write_file, read_file, trading_connections, trading_select_connection, trading_check, trading_account, trading_positions, trading_orders, trading_quote, trading_history, list_swarm_presets, run_swarm, get_market_data, get_fund_flow, get_dragon_tiger, get_northbound_flow, get_margin_trading, get_block_trades, get_shareholder_count, get_lockup_expiry, get_sector_info, get_research_reports, get_stock_news, get_sec_filings, get_financial_statements, get_options_chain, get_stock_profile, screen_market, search_symbol, get_macro_series, iwencai_search, get_swarm_status, get_run_result, list_runs, reap_stale_runs, retry_run, analyze_trade_journal, extract_shadow_strategy, run_shadow_backtest, render_shadow_report, scan_shadow_signals.

SWARM external MCP tools

run_swarm workers can call operator-approved tools from external MCP servers. Configure the server-side allowlist in VIBE_TRADING_SWARM_AGENT_CONFIG, ~/.vibe-trading/swarm-agent.json, or the fallback ~/.vibe-trading/agent.json; then list remote tools in a swarm preset using the local MCP wrapper name, such as mcp_internal_kb_search. Caller-provided variables stay template data only and cannot inject MCP URLs, commands, environment variables, or allowlist overrides.

---

🔌 Loading Tools from External MCP Servers (MCP Client Mode)

This is the opposite direction from the MCP Plugin above. The MCP Plugin lets other agents call Vibe-Trading tools. This section lets the built-in Vibe-Trading agent call tools from your external MCP servers.

Quick start

Create ~/.vibe-trading/agent.json:

{
  "mcpServers": {
    "my-server": {
      "command": "uvx",
      "args": ["my-mcp-server"]
    }
  }
}

Run any CLI command — tools from ordinary external servers are automatically injected into the agent’s registry after local tools:

vibe-trading run "use my-server to do X"

Official IBKR MCP read-only probe

Vibe-Trading can connect directly to Interactive Brokers’ official remote MCP endpoint in read-only mode. Add this to ~/.vibe-trading/agent.json:

{
  "mcpServers": {
    "ibkr": {
      "type": "streamableHttp",
      "url": "https://api.ibkr.com/v1/api/mcp",
      "auth": {
        "type": "oauth",
        "scopes": ["mcp.read"],
        "clientName": "Vibe-Trading",
        "cacheDir": "~/.vibe-trading/live/ibkr/oauth"
      },
      "enabledTools": ["*"]
    }
  }
}

Then start the browser OAuth flow:

vibe-trading connector authorize ibkr-live-official-mcp-readonly

The wildcard is accepted only for IBKR’s mcp.read probe. Authorizing this profile confirms access to IBKR’s official read scope; generic trading_account and trading_positions calls stay disabled until IBKR publishes stable read tool names that Vibe-Trading can map safely. A config that adds mcp.write must pin an explicit tool allowlist and still passes through the live order guard.

If IBKR issues a pre-registered OAuth client, add clientId and clientSecret inside auth.

Trading connectors: fastest path

For users who cannot wait for IBKR OAuth client approval, connect to a local TWS or IB Gateway session. Credentials stay inside IBKR’s desktop app; Vibe- Trading only connects to 127.0.0.1 and exposes it as a connector profile.

Install the optional SDK:

pip install "vibe-trading-ai[ibkr]"

Open TWS paper trading or IB Gateway paper, enable API socket clients, then run:

vibe-trading connector list
vibe-trading connector use ibkr-paper-local
vibe-trading connector configure ibkr-paper-local --yes
vibe-trading connector check
vibe-trading connector account
vibe-trading connector positions
vibe-trading connector orders
vibe-trading connector quote AAPL
vibe-trading connector history AAPL --duration "30 D" --bar-size "1 day"

Default local ports:

The agent exposes connector-scoped tools named trading_connections, trading_select_connection, trading_check, trading_account, trading_positions, trading_orders, trading_quote, and trading_history. Live-broker raw MCP tools are not registered directly as mcp__*. No IBKR order-placement tool is registered.

🔐 TAP Mode — full credential isolation & human-approved writes

Opt-in, off by default. If the TAP_* variables below are unset, the connector behaves exactly as before (direct broker SDK) — nothing changes.

TAP (Tool Authorization Protocol) is a credential proxy: the agent never holds the raw broker API secret, and consequential writes are gated on human approval. With TAP mode on, every Alpaca call — order placement, cancel, and the reads (account/positions/orders/quote/bars) — is sent to the TAP proxy’s /forward endpoint instead of the broker SDK; TAP injects the real key server-side, then forwards upstream.

• The agent process holds no Alpaca key at all — and doesn’t even need alpaca-py — because the whole egress goes through TAP. The secret is referenced by name (``) and TAP substitutes it.
• Writes block on human approval. An order or cancel cannot reach the broker without a human approving it; even a prompt-injected “buy now” is held, and denying it means it never reaches Alpaca. Orders carry a deterministic client_order_id, so an approval-race retry is deduplicated rather than double-placed.
• Reads auto-approve. Account/positions/orders/quote/bars are GETs that TAP forwards without a human step — this is credential isolation (no key in the process), not a gate, so there’s ~zero added friction.
• allowed_hosts on the TAP credential pins where the key may be sent, so a tampered target is rejected (403) before injection.

Enable it:

1. In the TAP dashboard, create a multi-secret credential named alpaca holding your Alpaca key pair as fields key_id and secret_key, assigned to your agent, with allowed hosts paper-api.alpaca.markets (or the live host api.alpaca.markets) and data.alpaca.markets (the market-data host used by quote/bars). Use separate TAP credentials for paper and live (e.g. alpaca-paper / alpaca-live, selected via TAP_ALPACA_CREDENTIAL), each with allowed_hosts pinned to its own API host — TAP then structurally refuses to send the paper key to the live host and vice versa, keeping the paper/live separation crisp end to end.
2. Add to agent/.env:

When a write is placed, approve or deny it in your TAP channel (Telegram / dashboard). An approved order/cancel is forwarded to Alpaca; a denied or timed-out one returns an error and is never sent.

Known limitation — approval race. If the human approves right at the TAP_APPROVAL_TIMEOUT boundary, TAP may forward the order while the poll has already given up: the gate then reports an error even though the order reached the broker, and the max_trades_per_day counter under-counts by one. The deterministic client_order_id keeps a retry from double-placing that order; if you rely on a tight trades-per-day cap, check open orders after a TAP timeout error before retrying.

Scope: covers Alpaca order placement, cancel, and all five reads — the full connector egress, so the process holds no key on any path. HMAC-signed brokers (Binance/OKX) are follow-ups (client-side signing doesn’t fit pure egress injection). The hooks are additive — they live inside the Alpaca connector and leave the live mandate gate unchanged.

Config reference

Config file location: ~/.vibe-trading/agent.json (JSON or YAML).

For URL-based transports, type is required. The agent no longer guesses between SSE and streamable HTTP from the URL suffix.

Per-session overrides (API)

When creating a session via the API you can pass mcpServers inside session.config to extend or override the global config for that session only:

{
  "config": {
    "mcpServers": {
      "research-server": {
        "command": "uvx",
        "args": ["research-mcp"],
        "enabledTools": ["search", "fetch"]
      }
    }
  }
}

Tool naming

Ordinary remote tools are exposed with stable names: mcp__. Live-broker MCP servers stay behind the trading_* connector surface.

If two server names produce the same ASCII-safe local prefix (e.g. foo-bar and foo_bar both become foo_bar), a deterministic hash suffix is appended at the server-segment level so names remain unique. The operator receives a warning:

WARNING: Configured MCP server 'foo-bar' collides with another server after local name
normalization. Using local tool prefix 'mcp_foo_bar__' to keep generated
tool names unique. Rename the server in agent config if you want a different prefix.

v1 limits

---

📁 Project Structure

---

🏛 Ecosystem

Vibe-Trading is part of the HKUDS agent ecosystem:

---

🗺 Roadmap

We ship in phases. Items move to Issues when work begins.

---

Contributing

We welcome contributions! See CONTRIBUTING.md for guidelines.

Good first issues are tagged with good first issue — pick one and get started.

Want to contribute something bigger? Check the Roadmap above and open an issue to discuss before starting.

---

Contributors

Thanks to everyone who has contributed to Vibe-Trading!

Recent v0.1.11 cycle contributors and credits:

• @shadowinlife — the api_server modularization capstone (1,103 → 371 lines, #424 closing #331), centralized env config with the AST CI gate (#440), loader fetch() protocol conformance (#437), and the Strategy Development Manager RFC in review (#455/#457) — 12 merged PRs this cycle
• @Robin1987China — Research Autopilot Phase 3 loop closure (#267), 4 canonical academic alphas (#277), Shadow Account PIT-safe entry conditions (#302/#314/#316), the turnover-aware portfolio optimizer (#466), scheduled-research route tests (#452), and test-coverage batches for trade-journal / pattern / loader layers (#268/#269/#276)
• @muku314115 — first-class Indian equity (NSE/BSE) support: the IndiaEquityEngine, cost stack, .NS/.BO routing, and the india_broker bridge (#305)
• @mvanhorn — the end-to-end scheduled-research executor (#278), the Trading 212 read-only connector (#321), OpenAI default-model resolution (#319), and Robinhood config validation (#320)
• @fei-moss — the analyze_image vision tool (#464), NapCat DM pairing (#463), and the IM-media allowed-roots report (#465)
• @sambazhu — the value-investing toolkit: financial-rigor + report-audit tools, 4 skills, and the value_investing_committee preset (#407/#408)
• @Elfsa-Miranda — the evidence-bound alpha research pipeline exploration (#405/#416, since re-scoped into #442)
• @Hinotoi-agent — loopback CSRF rejection (#293) and authenticated remote same-origin UI requests (#304)
• @dpersek — configurable IM reply timeout (#413) and the provider-preflight redirect fix (#404)
• @digger-yu — cross-platform setup/dev commands (#292) and dev-dependency pre-checks (#349)
• @skloxo — tilde expansion + file-roots safety fallback (#299) and reactive zh-CN localization (#301)
• @kadaliao — the beginner tutorial (#393) and Alpha Library social cards (#396)
• @morluto — CLI resume first-message preservation (#448) and the Codex OAuth default model (#446)
• @yxhuang — the Kimi for Coding provider (#435) and the precise #433 diagnosis behind the governance-stack revert
• @isaveall — the validation.json artifacts-dir fix (#429) and clearer --swarm-run errors (#428)
• @mustafakamal88 — timezone-aware UTC timestamps (#397)
• @irfanallana-oss — the zero-size order guard in trading_place_order (#417)
• @Shizoqua — the central OHLC-invariant loader guard (#274)
• @hobostay — SSRF-guard hardening for CGNAT/mesh ranges + the QQ media redirect fix (#389)
• @aeonframework — Pillow / langchain CVE floor bumps (#390)
• @hannibal-lee — the pandas version-constraint fix (#329)
• @MarkfuGod — dynamic data-source counts + token-gated microcompaction (#296)
• @gyx09212214-prog — strict JSON validation outputs (#306)
• @LemonCANDY42 — the backtest report library (#224)
• @fanfpy — Longbridge Decimal→float serialization (#459)
• @asahikiko — packaged SKILL.md capability-count sync + the manifest guard test (#461)
• @wison1717-maker — the mandate second-confirmation dialog + unified error toasts (#453)
• @imsankz — opencode provider mappings (#444)
• @flash1234pku — the tushare reference code-fence fix (#449)
• @Penn-Live — the Docker startup route-iteration crash report (#450)
• @warren618 / Haozhe Wu — the fundamental factor layer (PIT-safe SEC panels), the QVeris premium track, the IM channel runtime, India-equity integration review, CN search fallbacks, and release integration

---

Disclaimer

Vibe-Trading is research and trading software. It is not investment advice, holds no funds, and runs no execution venue. Trading through a broker channel you explicitly authorize (e.g. Robinhood Agentic Trading) happens only within the limits you set and which you can halt at any time. This broker-trading capability is experimental and not verified by us against a real broker account — use it at your own risk. Past performance does not guarantee future results.

License

MIT License — see LICENSE

---

⭐ If Vibe-Trading helps your research, a star helps more people find it.

---

Thanks for visiting Vibe-Trading ✨