Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed setup guide for Simmer’s trading MCP server, with sensitive access that matches its stated purpose.
Install only if you want this agent runtime to have persistent Simmer market and trading tools. Prefer local or project scope when available, avoid storing claimed live-trading keys on shared or cloud machines, and keep the default paper/sim behavior unless you deliberately enable the live-trading gates.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Case C — no agent registered yet. Register one now:
curl -X POST https://api.simmer.markets/api/sdk/agents/register \
-H "Content-Type: application/json" \
-d '{"name": "my-agent", "description": "What this agent does"}'
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
|---|---|
| macOS | Download installer from [nodejs.org](https://nodejs.org) (LTS) and double-click. Or `brew install node` if Homebrew is installed. |
| Windows | Download installer from [nodejs.org](https://nodejs.org) (LTS) and double-click. |
| Linux (Debian/Ubuntu) | `sudo apt update && sudo apt install nodejs npm` |
| Linux (Fedora/RHEL) | `sudo dnf install nodejs npm` |
The Node.js installer bundles npm, so installing Node.js gives you both. After install, the user needs to reopen their terminal so `node`/`npm` land on PATH, then re-run this step.
The skill instructs the agent/user to modify a sensitive persistent agent configuration file (~/.codex/config.toml) to register a new MCP server. This grants long-lived code execution capability to the referenced server in future sessions and changes trust boundaries beyond the current task.
Codex (the OpenAI CLI, `codex-cli`) reads **TOML**, not JSON, and ships its own MCP CLI —
do not paste the JSON block from the other runtimes into it. Its config file is
`~/.codex/config.toml`, or `$CODEX_HOME/config.toml` when that variable is set (the ChatGPT
desktop app sets it); every path below means whichever one your Codex reads.
**Write this block** under `mcp_servers` in that file. It is the whole entry; there is
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
**Tools listed but API calls return 401.**
- `SIMMER_API_KEY` env didn't make it into the MCP subprocess. The env block in the config has to be a direct value, not a `$VAR` reference — most MCP clients don't expand shell vars at server-launch time.
- Verify the key value: `printenv SIMMER_API_KEY | cut -c1-20` — must start with `sk_live_`. A common silent failure: install commands that use `pbpaste` or clipboard-read primitives can write the *install command text itself* as the key value when the user copies the command after copying the key. Fix: get a fresh key from [simmer.markets/dashboard](https://simmer.markets/dashboard?ref=sdk-skill&utm_campaign=sdk-skill), then `export SIMMER_API_KEY="sk_live_..."` typed/pasted directly.
**`npm install -g simmer-mcp` fails with EACCES on Linux/macOS.**
- Don't `sudo npm install` — that creates permission problems later. Either fix npm's global directory permissions per [npm's docs](https://docs.npmjs.com/resolving-eacces-permissions-errors-when-installing-packages-globally), or just use the `npx -y simmer-mcp@3.5.8` form in your config (no global install needed; npx fetches on first launch).
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
## Anti-patterns
- **Don't auto-install Node.js via `curl | sh`** — modifying the user's system without explicit approval is bad practice. Show the platform-specific install hint and let the user decide.
- **Don't paste the API key from clipboard into a pipe.** Use `read -s` (per [SIM-2118](https://github.com/SpartanLabsXyz/simmer/issues/2118)).
- **Don't `sudo npm install -g`.** Fix the underlying npm permissions, or use `npx -y simmer-mcp@3.5.8` in the config (no global install needed).
- **Don't tell the user "it should work now" without verifying.** Run Step 6 — confirm a real tool call returns real data.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Case C — no agent registered yet. Register one now:
curl -X POST https://api.simmer.markets/api/sdk/agents/register \
-H "Content-Type: application/json" \
-d '{"name": "my-agent", "description": "What this agent does"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Case C — no agent registered yet. Register one now:
curl -X POST https://api.simmer.markets/api/sdk/agents/register \
-H "Content-Type: application/json" \
-d '{"name": "my-agent", "description": "What this agent does"}'
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
|---|---|
| macOS | Download installer from [nodejs.org](https://nodejs.org) (LTS) and double-click. Or `brew install node` if Homebrew is installed. |
| Windows | Download installer from [nodejs.org](https://nodejs.org) (LTS) and double-click. |
| Linux (Debian/Ubuntu) | `sudo apt update && sudo apt install nodejs npm` |
| Linux (Fedora/RHEL) | `sudo dnf install nodejs npm` |
The Node.js installer bundles npm, so installing Node.js gives you both. After install, the user needs to reopen their terminal so `node`/`npm` land on PATH, then re-run this step.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
|---|---|
| macOS | Download installer from [nodejs.org](https://nodejs.org) (LTS) and double-click. Or `brew install node` if Homebrew is installed. |
| Windows | Download installer from [nodejs.org](https://nodejs.org) (LTS) and double-click. |
| Linux (Debian/Ubuntu) | `sudo apt update && sudo apt install nodejs npm` |
| Linux (Fedora/RHEL) | `sudo dnf install nodejs npm` |
The Node.js installer bundles npm, so installing Node.js gives you both. After install, the user needs to reopen their terminal so `node`/`npm` land on PATH, then re-run this step.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
|---|---|
| macOS | Download installer from [nodejs.org](https://nodejs.org) (LTS) and double-click. Or `brew install node` if Homebrew is installed. |
| Windows | Download installer from [nodejs.org](https://nodejs.org) (LTS) and double-click. |
| Linux (Debian/Ubuntu) | `sudo apt update && sudo apt install nodejs npm` |
| Linux (Fedora/RHEL) | `sudo dnf install nodejs npm` |
The Node.js installer bundles npm, so installing Node.js gives you both. After install, the user needs to reopen their terminal so `node`/`npm` land on PATH, then re-run this step.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
|---|---|
| macOS | Download installer from [nodejs.org](https://nodejs.org) (LTS) and double-click. Or `brew install node` if Homebrew is installed. |
| Windows | Download installer from [nodejs.org](https://nodejs.org) (LTS) and double-click. |
| Linux (Debian/Ubuntu) | `sudo apt update && sudo apt install nodejs npm` |
| Linux (Fedora/RHEL) | `sudo dnf install nodejs npm` |
The Node.js installer bundles npm, so installing Node.js gives you both. After install, the user needs to reopen their terminal so `node`/`npm` land on PATH, then re-run this step.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
|---|---|
| macOS | Download installer from [nodejs.org](https://nodejs.org) (LTS) and double-click. Or `brew install node` if Homebrew is installed. |
| Windows | Download installer from [nodejs.org](https://nodejs.org) (LTS) and double-click. |
| Linux (Debian/Ubuntu) | `sudo apt update && sudo apt install nodejs npm` |
| Linux (Fedora/RHEL) | `sudo dnf install nodejs npm` |
The Node.js installer bundles npm, so installing Node.js gives you both. After install, the user needs to reopen their terminal so `node`/`npm` land on PATH, then re-run this step.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
If `python3 -m venv` itself fails with *"ensurepip is not available"*, the venv module is
packaged separately on that distro: `sudo apt install python3-venv` (Debian/Ubuntu), or
use `pipx`, or as a last resort `pip install --break-system-packages`.
⚠️ **Creating the venv is not enough — you must point the server at it.** The server is
The skill directs the user to store a live API key literally in persistent MCP configuration (~/.claude.json). Persisting secrets in agent config increases exposure to local compromise, accidental disclosure in logs/backups, and unintended reuse across sessions.
This writes ~/.claude.json for you with the correct command/args/env structure. The "$SIMMER_API_KEY" expansion bakes the literal key value into the config (MCP runtimes don't expand shell vars at server-launch time).
Fallback (if claude mcp add isn't available in this Claude Code version): add the following to ~/.claude.json under mcpServers (create the key if it doesn't exist) — use the literal API key value, not $VAR:
{
"mcpServers": {
This Codex configuration guidance installs a persistent MCP server into global config, creating long-lived session persistence beyond the immediate task. Even though it forwards the secret by name rather than storing it literally, it still establishes durable execution and trust for future sessions.
~/.codex/config.toml, or $CODEX_HOME/config.toml when that variable is set (the ChatGPT
desktop app sets it); every path below means whichever one your Codex reads.
Write this block under mcp_servers in that file. It is the whole entry; there is
nothing else to add for Simmer:
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The phrase "Read-once, run-once" describes intended usage but does not specify how or when the skill should be invoked, nor what requests should not trigger it. Because SKILL.md is a markdown file, vague invocation guidance can cause the skill to be selected in overly broad setup contexts.