v2.1.2 — security: 0 vulnerabilities, declared capabilities, SSE warning

Response to the ClawHub security audit of 2.1.1. One finding was a false positive; four were worth acting on.

Dependencies: 9 vulnerabilities → 0

npm audit now reports 0 vulnerabilities, down from 9 (6 high). The cleared packages were all transitive: hono, express, path-to-regexp, fast-uri, body-parser, qs, ip-address, express-rate-limit, @hono/node-server.

The @modelcontextprotocol/sdk floor is raised ^1.12.1 → ^1.30.0, so a fresh install can no longer resolve the version the audit flagged.

Capabilities are now declared, not implicit

The skill manifest states exactly what this server touches:

• One env var — GRAPH_API_KEY, sent only to gateway.thegraph.com, never forwarded to Polymarket
• Three hosts — gateway.thegraph.com, gamma-api.polymarket.com, clob.polymarket.com
• No filesystem access

Anything outside that list is a bug.

SSE transport carries a warning

The optional --http transport is unauthenticated: anyone who can reach the port can call every tool and spend the operator's GRAPH_API_KEY quota. Both README and SKILL.md now say so plainly, and point at stdio — which has no network surface — as the better default.

On the "critical exposed secret"

The audit flagged smithery.yaml:16 as a hardcoded credential. That line is:

env: config.graphApiKey ? { GRAPH_API_KEY: config.graphApiKey } : {}

A template passing the user's own config value into an env var. No credential is present. Noted here rather than silently ignored, in case anyone reads the audit before the code.

---

No functional changes. 35 tools, verified over stdio after the dependency updates.

v2.1.1 — Polymarket CLOB V2 subgraphs + builder attribution

Adds Paul's four Polymarket CLOB V2 subgraphs alongside the existing V1 registry. 35 tools total — the v2.0.0 REST surface (Gamma + CLOB) is unchanged.

V1 and V2 are different eras, not old and new: the V2 subgraphs index from block 84902353 (the 2026-04-28 migration) and hold no earlier history, so all-time questions still belong on V1.

New — builder attribution

Every V2 fill carries the builder code of the frontend, bot or integrator that routed it. The V1 exchange contracts never emitted it, so this is new capability rather than a migration.

• get_builder_leaderboard — rank builders by routed volume, orders or fees, with each one's share of V2 volume
• get_builder_activity — recent fills for one builder code
• get_v2_top_traders — top real V2 traders, exchange contracts excluded
• check_subgraph_freshness — how far behind chainhead any subgraph is, read live from _meta

3,325 builders across $24B of V2 volume as of 2026-08-08.

Three traps handled for you

The exchange contracts look like traders. The V2 exchange is the taker when an order matches the book, so it accumulates an Account row. Ranking accounts naively returns 0xe111…996b (176M fills) and 0xe222…0f59 (41M) above every human by an order of magnitude. get_v2_top_traders filters them.

v2_main is ~86 days behind chainhead and catching up slowly. It answers queries — with mid-May data. Stale-not-broken is the dangerous case, so it carries a sync warning and check_subgraph_freshness measures it live rather than trusting a hardcoded date.

Three V1 deployments are no longer served on the network — beefy_pnl, resolution, traders. beefy_pnl is unreachable by deployment and subgraph id, and it backs get_account_pnl, get_top_traders, get_daily_stats and get_market_positions. This predates 2.1.x. The client now distinguishes "no indexer serves this" from "your query is wrong", so a model stops retrying a rewritten query into a wall.

beefy_pnl keeps metrics V2 P&L has no equivalent for — winRate, profitFactor, maxDrawdown, daily series — so trader-quality scoring stays pointed at V1 by design.

---

npm i graph-polymarket-mcp@2.1.1 · also on ClawHub

v2.0.0 — Polymarket REST API Integration (Gamma + CLOB)

What's New

Integrated Polymarket's public REST APIs (inspired by polymarket-cli) alongside the existing Graph subgraph tools. 31 tools total, up from 20.

11 New Tools (no API key needed)

Market Discovery (Gamma API)

• search_markets — search by text query with filters (active, closed, sort by volume/liquidity)
• get_market_info — detailed market metadata by slug or condition ID
• list_polymarket_events — browse event groups with tag/status filters
• get_polymarket_event — single event with all child markets

Real-Time Trading Data (CLOB API)

• get_live_prices — real-time buy/sell prices (single or batch)
• get_live_spread — bid-ask spread + midpoint
• get_live_orderbook — full order book (all resting bids/asks)
• get_price_history — historical price time-series (1m to max)
• get_last_trade — last trade price

Bridging Tools

• get_clob_market — bridge condition IDs to CLOB token IDs with live prices
• search_markets_enriched — power tool: search + auto-enrich with live CLOB prices AND on-chain resolution status in one call

New Prompt

• market_deep_dive — guided workflow chaining Gamma search → CLOB prices/history → Graph OI/resolution

Improved Tool Descriptions

• All tools now explicitly document which fields (conditionId, tokenId, clobTokenIds) bridge to other tools
• Agents can naturally chain from market search → live prices → on-chain analytics

Three Data Sources, One MCP

Source	What it provides
Gamma API	Text search, market metadata, event groupings
CLOB API	Real-time prices, order books, spreads, price history
The Graph (8 subgraphs)	Trader P&L, open interest, on-chain activity, resolution disputes

Setup

claude mcp add graph-polymarket -- npx -y graph-polymarket-mcp

Free Graph API key for subgraph tools. Gamma/CLOB tools work with no key.

v1.5.0 — Dual Transport (OpenClaw Ready)

What's New

• Dual transport support — serve both stdio (Claude Desktop, Cursor, Claude Code) and SSE/HTTP (OpenClaw, remote agents) from a single process
• CLI flags: --http (dual), --http-only (SSE only), MCP_HTTP_PORT env var
• SKILL.md for ClawHub registry
• Default SSE port: 3851

Transport Modes

Invocation	Transports	Use case
npx graph-polymarket-mcp	stdio	Claude Desktop, Cursor, Claude Code
npx graph-polymarket-mcp --http	stdio + SSE :3851	Dual — local + remote agents
npx graph-polymarket-mcp --http-only	SSE :3851	OpenClaw, remote deployments

v1.1.4

MCP server for querying Polymarket prediction market data via The Graph subgraphs.

What's included

• 9 tools for querying market data, trader P&L, positions, activity, and orderbook trades
• Support for 5 Polymarket subgraphs
• Works with Claude Desktop, Claude Code, Cursor, and any MCP-compatible client