v0.1.12 — external-data fetch tool

Adds a narrowly-scoped external-data fetch tool for research-agent consumers, plus MCP-conformance linting and dependency updates.

Highlights

• feat: new kalshi_fetch_external_data tool — a read-only, GET-only, https-only, exact-host-allowlisted fetch of a handful of public data feeds (Polymarket gamma/clob, NWS api.weather.gov, Open-Meteo incl. ensemble, Tennis Abstract, Deribit public). No credentials attached (trust_env=False), redirects not followed, body size- and wall-clock-capped, and returned wrapped in UNTRUSTED-EXTERNAL-DATA delimiters. It exists because consumers whose own egress is restricted (e.g. claude.ai cloud routines) can't reach these public feeds directly; the allowlist is the load-bearing control and additions are a code change. Forks that don't want the surface can delete the module + its registration line (#59).
• ci: lint the MCP setup with mcpconform (0.2.0 flags), dropping the old shell guard + suppressions (#43, #44).
• docs(tools): document tool params and fit the safety-tool description under OpenAI's 1024-char limit (#42).
• fix(live): document the intentional TimeoutError swallow flagged by CodeQL (#41).
• deps: routine dependency and GitHub Actions bumps (cryptography, starlette, python-multipart, pydantic-settings, and pinned action SHAs).

Install

pipx install kalshi-mcp-server

Multi-arch image: ghcr.io/cejor6/kalshi-mcp-server:v0.1.12 (and :latest).

Full changelog: v0.1.11...v0.1.12

v0.1.11 — candlestick validation

Candlestick validation — turn two silent Kalshi footguns into actionable errors.

Highlights

• fix(market-data): validate candlestick params before the HTTP call. period_interval is now a Literal[1, 60, 1440] enum in the tool schema and a runtime check (Kalshi 400s opaquely on 5/240/etc.), and the ≤5000-candle window cap is enforced with a clear "widen the interval or narrow the window" message instead of an opaque 400 bad request. Constraints are baked into the tool JSON-Schema so schema-aware clients steer the model to valid values (#36).

Install

pipx install kalshi-mcp-server

Multi-arch image: ghcr.io/cejor6/kalshi-mcp-server:v0.1.11.

Full changelog: v0.1.10...v0.1.11

v0.1.10 — runtime-tunable safety limits

Runtime-tunable safety limits — tighten the risk envelope without a redeploy.

Highlights

• feat(safety): the four per-order caps (MCP_MAX_ORDER_SIZE_USD, MCP_DAILY_LIMIT_USD, MCP_MAX_CONTRACTS_PER_ORDER, MCP_CASH_RESERVE_USD) can now be tightened at runtime via kalshi_set_safety_limits — a fast clamp-down with no redeploy. The env vars remain the hard ceiling: the three caps may only go down, the cash reserve only up, and a runtime actor can never loosen past the env ceiling (fail-closed). Optional Redis persistence (MCP_REDIS_URL) makes a clamp-down survive restarts; in-memory otherwise. The tool is gated by MCP_ALLOW_RUNTIME_LIMIT_TUNING (#27, #35).

Install

pipx install kalshi-mcp-server

Multi-arch image: ghcr.io/cejor6/kalshi-mcp-server:v0.1.10.

Full changelog: v0.1.9...v0.1.10

v0.1.9 — discovery ergonomics

Discovery ergonomics for LLM agents scanning the market listing.

Highlights

• feat(discovery): minimal field projection — project each market down to a small triage whitelist (ticker, prices, sizes, volume, status, close time), bounding worst-case payload size for KXMVE… combo markets. Also drops the always-0.0000 liquidity_dollars field from curated views so agents don't gate on it (#28, #31, #32).
• feat(discovery): mve_filter to exclude multivariate combo markets server-side, a new kalshi_find_liquid_markets helper (volume-ranked, combo-excluded shortlist over a bounded scan window), and actionable event-ticker-vs-market-ticker hints when the wrong ticker type is passed (#29, #30, #33).
• fix(registry): shorten server.json description to ≤100 chars for registry validation (#26).

Install

pipx install kalshi-mcp-server

Multi-arch image: ghcr.io/cejor6/kalshi-mcp-server:v0.1.9.

Full changelog: v0.1.8...v0.1.9

v0.1.8 — MCP Registry submission

Prep release for the MCP Registry submission.

What's changed

• chore: prepare the MCP Registry submission — server.json / server.yaml manifests wired up so the server can be published to registry.modelcontextprotocol.io as io.github.cejor6/kalshi-mcp-server (#25).

Install

pipx install kalshi-mcp-server

Also published as a multi-arch image: ghcr.io/cejor6/kalshi-mcp-server:v0.1.8.

Full changelog: v0.1.7...v0.1.8

v0.1.7 — first public release

The first public release of kalshi-mcp-server — a Model Context Protocol server for Kalshi prediction markets. Works with any MCP client (Claude Desktop, Claude Code, Cursor, Zed, Continue, Cline, Goose) over local stdio, or hosted remotely over Streamable HTTP with a bundled OAuth proxy.

Warning

This software places real trades when you enable trading against a production account. Markets carry financial risk, and LLMs make mistakes. Read DISCLAIMER.md before connecting a funded account. Defaults are read-only against the demo environment.

Highlights

• 26 tools spanning market discovery, order books, candlesticks, trades, positions, fills, settlements, account balance, and order management.
• Native RSA-PSS request signing — no third-party SDK; canonical timestamp + METHOD + path message, ms timestamps, per the Kalshi API spec.
• Token-bucket rate limiting matching Kalshi's tier model (basic → prime), auto-hydrated from /account/limits at startup.
• Layered safety controls — read-only by default, KALSHI_TRADING_ENABLED=0 gate, KALSHI_ALLOW_PROD=1 gate for production, a daily order cap, and a two-step prepare → confirm flow so an LLM can never place an order in a single call.
• Separate demo / prod endpoints and key pairs, fail-closed.
• Remote hosting — Streamable HTTP transport with a bundled GitHub OAuth proxy (OAuth 2.1 + PKCE + Dynamic Client Registration), GitHub-login allowlist, and Upstash Redis for client persistence. See DEPLOY.md.

Install

pipx install kalshi-mcp-server

Also published as a multi-arch image at ghcr.io/cejor6/kalshi-mcp-server:v0.1.7. Setup and client config for each MCP client is in the README.

Supply-chain & CI

• PyPI Trusted Publishing via OIDC — no long-lived token.
• All third-party GitHub Actions pinned to commit SHAs.
• CodeQL, gitleaks secret scanning, dependency review, and pre-commit detect-secrets on every PR.

Changelog (0.1.0 → 0.1.7)

• 0.1.7 — Hash-pin all third-party GitHub Actions to commit SHAs (#24)
• 0.1.6 — PyPI Trusted Publishing on tag push (#23)
• 0.1.5 — Model-agnostic docs reframe; clearer hosting decision flow (#22)
• 0.1.4 — Render deploy hook on tag push; DEPLOY.md correction (#16)
• 0.1.3 — 13 fixes from an end-to-end testing pass: response compaction, ticker validation, 3xx handling, startup rate-limit hydration (#15)
• 0.1.2 — Install [oauth] extras in the published image (#11)
• 0.1.1 — Bind to 0.0.0.0 in the published image so remote hosts can route (#10)
• 0.1.0 — Initial server: tools, RSA-PSS auth, rate limiting, safety controls, WebSocket live-data client (#7), OAuth proxy (#8)

Full changelog: https://github.com/cejor6/kalshi-mcp-server/commits/v0.1.7

---

MIT licensed. Not affiliated with Kalshi.