# Quote.Trade MCP Adapter

> Quote.Trade MCP: login, deposit address, market data, orders, and withdraws.

- name: trade.quote/mcp
- version: 1.5.8
- connection class: R0 (autonomous)
- trust: 80/100 flags: no-repository
- quality: 80/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/trade.quote%2Fmcp
- tools: https://api.protogrid.dev/v1/servers/trade.quote%2Fmcp/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "quote": {
      "type": "http",
      "url": "https://quote.trade/mcp",
      "headers": {
        "X-MBX-APIKEY": "${X_MBX_APIKEY}",
        "X-MBX-APISECRET": "${X_MBX_APISECRET}"
      }
    }
  }
}
```

Placeholders to fill: `${X_MBX_APIKEY}`, `${X_MBX_APISECRET}`.

## Trust

- hygiene: 80
- liveness: 100
- freshness: 85
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-99% ~updated-33d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 80/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 86 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 25 of 25 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: quote_trade_api_discovery (idempotentHint); quote_trade_get_index_positions (idempotentHint); quote_trade_withdraw_preview (idempotentHint); …
- pass `tools.token_cost`: about 4,215 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 75 (weight 15)

- warn `stability.changes`: 6 tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 25, about 4,215 tokens to load them all
- tool set hash: 17fccbee0b85b46d95d4e641075cfb77
- tools last changed: 2026-09-28T21:30:14.225Z
- badge: [![protogrid quality](https://protogrid.dev/badge/trade.quote/mcp.svg)](https://protogrid.dev/servers/trade.quote/mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-09-28 `quote_trade_withdraw` changed (description)
  - before: Withdraw step 3. POST /api/sendWithdrawWithVTokenRequest for stablecoins only (USDC|USDT|XUSDC) to the user's own login wallet (no toAddress). Not available for BTC/ETH/other assets. Requires a full-access API key with withdraw entitlement (trade-only keys are rejected by Quote.Trade), tradingEnabled, allowedWithdrawAssets (independent of the trading allowedSymbols allowlist), and maxNotionalUsd>0. humanApproved/approvalText are agent friction only.
  - after: Withdraw step 3. POST /api/sendWithdrawWithVTokenRequest for stablecoins only (USDC|USDT|XUSDC) to the user's own login wallet (no toAddress). Not available for BTC/ETH/other assets. Requires a full-access API key with withdraw entitlement (trade-only keys are rejected by Quote.Trade), tradingEnabled, and allowedWithdrawAssets (independent of the trading allowedSymbols allowlist). No MCP USD notional cap applies. humanApproved/approvalText are agent friction only.
- 2026-09-28 `quote_trade_withdraw_preview` changed (outputSchema)
- 2026-09-28 `quote_trade_place_order` changed (description)
  - before: Trade step 4. POST /api/order with a suitable price after instruments/ticker/depth. Requires tradingEnabled, allowedSymbols (* or explicit list; empty denies), maxNotionalUsd>0, and API credentials. Sending X-MBX-APISECRET to this MCP host grants it full signing authority. humanApproved/approvalText are agent friction only.
  - after: Trade step 4. POST /api/order with a suitable price after instruments/ticker/depth. Requires tradingEnabled, allowedSymbols (* or explicit list; empty denies), and API credentials. No MCP USD notional cap applies. Sending X-MBX-APISECRET to this MCP host grants it full signing authority. humanApproved/approvalText are agent friction only.
- 2026-09-28 `quote_trade_order_preview` changed (outputSchema)
- 2026-09-28 `quote_trade_api_manifest` changed (outputSchema)
- 2026-09-28 `quote_trade_api_discovery` changed (outputSchema)

Full history: https://api.protogrid.dev/v1/servers/trade.quote%2Fmcp/changes

## Remotes

- https://quote.trade/mcp (streamable-http, auth none, reachable true, uptime30d 0.9916667)

## Packages

_none_

## Tools (25)

- `quote_trade_account`: Withdraw step 1 / anytime account check. GET /api/account with per-request X-MBX-APIKEY. Inspect available balances before withdraw. No live trading action.
- `quote_trade_api_discovery`: Read once to learn efficient direct REST/WebSocket use: routes, signing, streaming, cumulative depth, and client execution controls. Public guidance only; no upstream calls.
- `quote_trade_api_manifest`: Explains that MCP is only a tool/schema adapter around the existing Quote.Trade APIs, and returns local servlet guardrail configuration.
- `quote_trade_cancel_order`: Cancel one order by orderId. POST /api/cancelOrder. Identifies exactly one order via the matching engine's single-order cancel path - NOT a mass-cancel. There is no quote_trade_cancel_all: the upstream mass-cancel action's scope for edge-case parameters could not be verified from this codebase alone and is intentionally not exposed through MCP. Requires tradingEnabled, allowedSymbols (same allowlist as quote_trade_place_order), and a trade-scoped API key. No notional check applies: a cancellation has none. humanApproved/approvalText are agent friction only.
- `quote_trade_depth`: Trade step 3. GET /api/depth?symbol=SYMBOL&limit=N. Use depth quantity to choose a suitable limit price before placing an order.
- `quote_trade_exchange_info`: Call GET /api/exchangeInfo and return a paginated slice of trading symbols plus rate limits/server time. Upstream has no pagination, so this adapter filters/slices locally. Default limit=50, max=200. Prefer quote_trade_instruments for compact tradable-pair discovery.
- `quote_trade_get_challenge`: Optional wallet login/register step 1 (not required for trading with an existing API key). POST /api/getChallenge with a wallet address (login). Returns challenge text and isNewUser. Step 2: sign the challenge with the wallet outside MCP. Step 3: quote_trade_logon. No API key required.
- `quote_trade_get_deposit_address`: Deposit step 1. GET /api/getDepositAddress?symbol=ASSET and return chain + contract/address. Supported assets: USDC and USDT (mainnet), XUSDC (USDC on XDC). Step 2 is transferring funds to that address outside MCP (no backend call).
- `quote_trade_get_deposit_history`: Anytime deposit check. POST /api/getDepositHistory with per-request X-MBX-APIKEY. Requires a trade-scoped API key (same scope as quote_trade_place_order). Read-only: no live trading action.
- `quote_trade_get_index_positions`: Anytime position check. POST /api/getIndexPositions with per-request X-MBX-APIKEY. Distinct from quote_trade_get_positions: index/basket instrument positions rather than regular instrument positions. Optional assetType filter. Read-only: no live trading action.
- `quote_trade_get_order_history`: Anytime order check. POST /api/getOrderHistory with per-request X-MBX-APIKEY. Full order history, or one order's history with optional orderId. Requires a trade-scoped API key (same scope as quote_trade_place_order). Read-only: no live trading action.
- `quote_trade_get_orders`: Anytime order check. POST /api/getOrders with per-request X-MBX-APIKEY. Read-only: no live trading action. Requires read entitlement on API keys that carry one.
- `quote_trade_get_order_status`: Anytime order check. POST /api/orderStatus with per-request X-MBX-APIKEY. Query the status of an order previously placed with quote_trade_place_order. Read-only: no live trading action.
- `quote_trade_get_positions`: Anytime position check. GET /api/positions with per-request X-MBX-APIKEY. Reconcile current positions when starting or reconnecting, per the direct-discovery guide (quote_trade_api_discovery / rest.privateReads). No live trading action.
- `quote_trade_get_risk`: Anytime risk check. POST /api/getRisk with per-request X-MBX-APIKEY. Margin/equity/unrealized-PnL summary for the authenticated account. Read-only: no live trading action.
- `quote_trade_get_user_wallets`: Anytime wallet check. POST /api/getUserWallets with per-request X-MBX-APIKEY. On-chain addresses previously seen depositing to the authenticated account. Read-only: no live trading action.
- `quote_trade_get_withdraw_requests`: Anytime withdrawal check. POST /api/getWithdrawRequests with per-request X-MBX-APIKEY. Inspect the status of withdrawals already submitted (including via quote_trade_withdraw). Requires a trade-scoped API key. Read-only: no live trading action, and this tool cannot cancel a withdrawal.
- `quote_trade_instruments`: Trade step 1. GET /api/getInstrumentPairs — paginated tradable symbols/instruments. Default limit=50, max=200. Use skip to page. Pick a symbol from this response for ticker/depth/order calls.
- `quote_trade_logon`: Optional wallet login/register step 3 (not required if the agent already has an API key). Pass challenge + wallet signature from steps 1–2. isNewUser=true -> POST /api/registerUser; else POST /api/logon. On success, map body.requestToken/requestSecret to X-MBX-APIKEY / X-MBX-APISECRET; use body.id as account. Wallet signing stays outside MCP.
- `quote_trade_order_preview`: Optional before live trade. Normalize/validate a BUY/SELL order locally without sending it.
- `quote_trade_place_order`: Trade step 4. POST /api/order with a suitable price after instruments/ticker/depth. Requires tradingEnabled, allowedSymbols (* or explicit list; empty denies), and API credentials. No MCP USD notional cap applies. Sending X-MBX-APISECRET to this MCP host grants it full signing authority. humanApproved/approvalText are agent friction only.
- `quote_trade_status`: Call GET /api/status and return system status, server time, contracts URL, and feature flags.
- `quote_trade_ticker`: Trade step 2. GET /api/ticker?symbol=SYMBOL for a symbol from quote_trade_instruments. Returns last price, bid, ask, lastUpdateId.
- `quote_trade_withdraw`: Withdraw step 3. POST /api/sendWithdrawWithVTokenRequest for stablecoins only (USDC|USDT|XUSDC) to the user's own login wallet (no toAddress). Not available for BTC/ETH/other assets. Requires a full-access API key with withdraw entitlement (trade-only keys are rejected by Quote.Trade), tradingEnabled, and allowedWithdrawAssets (independent of the trading allowedSymbols allowlist). No MCP USD notional cap applies. humanApproved/approvalText are agent friction only.
- `quote_trade_withdraw_preview`: Optional before live withdraw. Stablecoins only: USDC, USDT, or XUSDC (not BTC/ETH/other). Own login wallet only (no toAddress). estimatedNotional is USD at $1 peg. Trade-only API keys cannot withdraw — use a full-access key with withdraw entitlement.