EOLAS MCP

Trade perpetual futures and send social updates via EOLAS DEX. Place and manage orders on Orderly Network, post updates to Telegram or X/Twitter.

Security Scan

The skill's stated purpose (trading + social posting) aligns with its instructions, but there are inconsistencies and moderate supply-chain risks (global npm installs, external MCP servers) that warrant caution before installing.

Purpose & Capability

Name/description (trade perps + social posting) matches the tools and functionality described. However, the SKILL.md instructs installing two additional MCP server packages (eolas-edge-mcp, eolas-reach-mcp) via `npm install -g`, but the registry metadata declares no required binaries — an omission. Installing global helper daemons is coherent for a bridge plugin, but the mismatch between declared requirements and runtime instructions is an incoherence the user should be aware of.

Instruction Scope

Instructions stay within the claimed domain: they tell the user to install MCP servers, enable the plugin in ~/.openclaw/openclaw.json, and mention local credential storage at ~/.openclaw/eolas/keychain.json. SKILL.md asserts credentials are only sent to api.orderly.org, but that claim cannot be verified from this instruction-only package. The plugin will spawn child processes (MCP servers) and communicate over stdio — behavior that broadens runtime scope and should be audited in the actual packages.

Install Mechanism

The declared install spec is an npm package (eolas-openclaw-mcp) which is a typical mechanism, but the runtime setup explicitly requires global npm installs of eolas-edge-mcp and eolas-reach-mcp. Global npm installs run arbitrary package install scripts and place binaries on the host — a moderate supply-chain risk. The SKILL.md points to npm and GitHub pages (good), but there is no code included in the registry to audit here, and the global installs are not surfaced in the registry's required binaries list.

Credentials

The skill declares no required environment variables and lists optional config keys for Telegram, X/Twitter (creatorBidApiKey), and Replicate. That is proportionate to its social features. Trading credentials are claimed to be stored locally in ~/.openclaw/eolas/keychain.json — storing keys locally is reasonable, but the file is sensitive and the SKILL.md's claim that credentials are only sent to api.orderly.org cannot be verified without inspecting the MCP packages. No unrelated credentials are requested in the metadata.

Persistence & Privilege

The skill is not always-enabled and does not claim any elevated platform privileges. It will spawn MCP child processes when the gateway starts and requires enabling in the OpenClaw config, which is normal for a plugin. There is no evidence it modifies other plugins or system-wide settings beyond its own config entry.

What to consider before installing

This skill appears to do what it says (on-chain trading + social posting) but proceed carefully: 1) The SKILL.md asks you to run `npm install -g eolas-edge-mcp eolas-reach-mcp` — global npm installs can execute arbitrary code. Inspect the npm pages and upstream GitHub repos for those packages (and the eolas-openclaw-mcp package) before installing. 2) Verify the maintainers, package versions, and recent activity/ratings on npm/GitHub. 3) Review the source of the MCP packages (they are the runtime components that will be spawned and communicate over stdio) to confirm network endpoints and that they only call the expected APIs (api.orderly.org, perps.eolas.fun, Telegram/Twitter/Replicate endpoints). 4) Treat ~/.openclaw/eolas/keychain.json as sensitive: back it up and ensure it's stored with proper file permissions; consider using a test account with limited funds first. 5) If possible, run the MCP components in an isolated environment (container or VM) to observe behavior before granting access to real keys/funds. 6) Because this registry entry includes no code to audit, prefer installing only after reviewing the linked GitHub repository and npm package contents. If you are uncomfortable auditing these upstream packages, do not install or enable the plugin.

EOLAS Skill

Connect your OpenClaw agent to the EOLAS perpetuals exchange (perps.eolas.fun) and social tools.

Setup

1. Install the EOLAS MCP servers (required):

npm install -g eolas-edge-mcp eolas-reach-mcp

2. Install this plugin:

openclaw plugins install eolas-openclaw-mcp

3. Add to ~/.openclaw/openclaw.json:

{
  "plugins": {
    "allow": ["eolas-openclaw-mcp"],
    "entries": {
      "eolas-openclaw-mcp": {
        "enabled": true,
        "config": {
          "telegramBotToken": "optional - for Telegram messaging",
          "creatorBidApiKey": "optional - for X/Twitter posting",
          "replicateApiToken": "optional - for image generation"
        }
      }
    }
  }
}

All config keys are optional — only add what you need. No keys are stored in code; they live in your local OpenClaw config only.

Credential storage: Trading account credentials are stored locally at ~/.openclaw/eolas/keychain.json on first use. No credentials are sent anywhere except to the EOLAS API (api.orderly.org).

Trading

• "What markets are available on EOLAS?"
• "Show me the BTC funding rate"
• "Long ETH with $20, 3% stop loss, 6% take profit"
• "Show my open positions"
• "Close my BTC position"
• "What is my account balance?"
• "Scan markets for the best opportunity"

Social

• "Send a Telegram message: BTC just hit $X"
• "Post a tweet about this trade"
• "Get my latest Twitter mentions"
• "Generate an image for this signal"

Tools

Trading (13 tools via EOLAS Edge → Orderly Network, Base mainnet)

• eolas_get_markets — list all markets
• eolas_get_market_info — price, funding rate, open interest
• eolas_get_account_balance — account balance
• eolas_get_positions — open positions
• eolas_get_orders — order history
• eolas_get_tradingview_candles — OHLCV data
• eolas_place_order — market or limit order
• eolas_place_bracket_order — order with take profit + stop loss
• eolas_cancel_order — cancel an order
• eolas_close_all_positions — close all positions
• eolas_manage_funds — deposit or withdraw USDC
• eolas_screen_assets — scan markets for setups
• eolas_swap_token_on_uniswap — swap tokens on Base

Social (16 tools via EOLAS Reach)

• eolas_send_telegram_message — send to Telegram
• eolas_get_telegram_updates — read Telegram messages
• eolas_create_twitter_post — post on X/Twitter
• eolas_reply_to_twitter_post — reply to a tweet
• eolas_get_twitter_mentions — read mentions
• eolas_generate_image — generate image via Replicate
• eolas_generate_brand_image — EOLAS branded image
• eolas_generate_seedance_video — generate video
• eolas_merge_videos — merge video clips
• eolas_add_reference_image — add reference image
• eolas_list_reference_images — list reference images
• eolas_add_brand_template — add brand template
• eolas_list_brand_templates — list brand templates
• eolas_delete_brand_template — delete brand template
• eolas_list_available_fonts — list fonts
• eolas_generate_nano_banana_image — nano banana image

Links

• EOLAS DEX: https://perps.eolas.fun
• Plugin on npm: https://npmjs.com/package/eolas-openclaw-mcp
• EOLAS Docs: https://eolas.gitbook.io/eolas
• Source: https://github.com/Albertech2005/eolas-openclaw-mcp