nexustrader

NexusTrader trading assistant. Query crypto balances, positions, prices, and place orders on Binance, Bybit, OKX, Bitget, HyperLiquid.

Security Scan

The skill appears to implement what it claims: a local bridge to a NexusTrader MCP server that reads local exchange API keys and can query/place orders; its requirements and files are proportionate to that purpose.

Purpose & Capability

Name/description match the actual code and instructions. The skill needs python3, the 'uv' CLI, and the fastmcp Python package to operate a local MCP server and call exchange-backed tools; it reads local .keys/.secrets.toml for API keys which is necessary for trading.

Instruction Scope

SKILL.md and bridge.py keep behavior narrowly scoped to interacting with a local MCP server (default 127.0.0.1:18765) and reading .env and the project's .keys/.secrets.toml. The skill relies on the agent/user to confirm order operations (the code does not itself enforce an interactive confirmation flow), and it allows an opt-in auto-start of a background daemon which, if enabled, will hold access to API keys. These are documented but are important operational considerations.

Install Mechanism

There is no automatic remote install specified in the skill registry. Provided install.sh is a local helper that expects the user to clone the upstream GitHub repo and to install 'uv' themselves; it does not silently pull arbitrary code from untrusted servers. The script can update the local OpenClaw skill registry (index.json) when run, which is expected for an installer but worth noting.

Credentials

The only privileged credential is the local-file credential NEXUSTRADER_API_KEYS (.keys/.secrets.toml) — appropriate for a trading integration. The skill declares optional environment variables (NEXUSTRADER_PROJECT_DIR, NEXUSTRADER_MCP_URL, NEXUSTRADER_NO_AUTOSTART). Access to the API key file is high-privilege but proportional to the stated functionality. Be aware that enabling auto-start gives the daemon continuous access to those keys.

Persistence & Privilege

The skill is not always:true and does not auto-enable itself by default. However, it can auto-start a background nexustrader-mcp daemon if the user opts in (NEXUSTRADER_NO_AUTOSTART=0). The install script can also modify ~/.openclaw/skills/index.json when run. These are documented behaviors but increase runtime persistence/privilege when the user enables them.

Assessment

This skill is internally coherent for running a local NexusTrader MCP bridge, but you should: (1) review and control the NexusTrader-mcp source you install (the installer expects you to git clone https://github.com/Quantweb3-com/NexusTrader-mcp), (2) start with testnet/demo keys and verify the workflow before using live keys, (3) keep auto-start disabled (NEXUSTRADER_NO_AUTOSTART=1) unless you understand and accept that a background daemon will hold access to your API keys, (4) inspect install.sh and bridge.py yourself before running them, and (5) remember the agent is responsible for confirming trades — the code documents that requirement but does not enforce a human-in-the-loop confirmation itself.

Use the exec tool to run bridge.py. Do not write code or call external HTTP APIs directly. bridge.py connects to a local MCP server at 127.0.0.1:18765 (SSE) — all exchange communication goes through that server.

Security Considerations

This skill accesses your exchange API keys. Before using:

• API keys are stored in {NEXUSTRADER_PROJECT_DIR}/.keys/.secrets.toml — a local file, never transmitted by this skill.
• Auto-start is disabled by default. The skill will not start background processes unless you explicitly set NEXUSTRADER_NO_AUTOSTART=0 in the skill's .env file.
• If auto-start is enabled, the NexusTrader-mcp daemon will run in the background and hold access to your API keys.
• Start with testnet/demo keys. Only use real keys after verifying the workflow in a sandbox.
• Orders require explicit user confirmation — verify your agent flow enforces this before live trading.
• See upstream docs for key setup: https://github.com/Quantweb3-com/NexusTrader-mcp

Environment Variables

• NEXUSTRADER_PROJECT_DIR (optional, default: ~/NexusTrader-mcp): Location of your NexusTrader-mcp project directory. Controls where .keys/.secrets.toml is read from.
• NEXUSTRADER_NO_AUTOSTART (default: 1): Set to 0 to allow bridge.py to auto-start the MCP daemon when offline. Default 1 means you must start the server manually.
• NEXUSTRADER_MCP_URL (optional, default: http://127.0.0.1:18765/sse): MCP server address if running on a non-default port.

Usage

Get all balances: exec {baseDir}/bridge.py get_all_balances

Get all positions: exec {baseDir}/bridge.py get_all_positions

Get balance for one exchange: exec {baseDir}/bridge.py get_balance --exchange=okx

Get ticker: exec {baseDir}/bridge.py get_ticker --symbol=BTCUSDT-PERP.BINANCE

Get klines: exec {baseDir}/bridge.py get_klines --symbol=BTCUSDT-PERP.BINANCE --interval=1h --limit=24

Get open orders: exec {baseDir}/bridge.py get_open_orders --exchange=okx

Get position for one symbol: exec {baseDir}/bridge.py get_position --symbol=BTCUSDT-PERP.OKX

Place order (confirm first): exec {baseDir}/bridge.py create_order --symbol=BTCUSDT-PERP.BINANCE --side=BUY --order_type=MARKET --amount=0.001

Cancel order (confirm first): exec {baseDir}/bridge.py cancel_order --symbol=BTCUSDT-PERP.BINANCE --order_id=123

Symbol format: BTCUSDT-PERP.OKX / ETHUSDT-SPOT.BYBIT. Exchange names lowercase.

If exec returns {"error": ...} → explain in Chinese. If server not running → tell user to start manually: cd ~/NexusTrader-mcp && uv run nexustrader-mcp start

For orders, always confirm with user before calling create_order/cancel_order/modify_order.