OpenMM

This package is coherent for trading use, but handle credentials and runtime installs carefully: - Only provide API keys with the minimum permissions required (read + trade; disable withdrawals). - Keep order-placing and strategy-starting tools disabled unless you explicitly allow them in your agent config; the plugin marks these as optional and documents allowlisting — follow that. - Prefer pinning package versions instead of using 'latest' to reduce supply-chain/upgrade risk. Audit the npm packages (@3rd-eye-labs/openmm, @qbtlabs/*) and their GitHub sources before installing. - Be cautious when running 'npx' (MCP server example) because npx downloads and executes package code at run time. Run it only in a trusted environment or after auditing the package. - Store API keys in a secure secrets store if possible, or ensure plugin-config storage is protected; never commit .env files or credentials to source control. - If you need higher assurance, review the upstream GitHub repositories and npm package contents (verify maintainers, inspect package code and release history) before installing on any production account or using real funds. If you want, I can list the exact places in the code and docs that handle credentials and the tool registration lines that perform CLI execs so you can review them in detail.