Reference

MCP server

Connect an AI agent to your own account with the Model Context Protocol. It can read what you can see — connected accounts, value, positions, performance, trades, the return curve — and nothing else. There is no tool that connects an account, places an order, moves funds or changes a setting.

Get a token

Create one at /settings/api-tokens. It looks like lvz_ro_…, is shown once, and only its hash is kept after that — if you lose it, revoke it and create another. You can hold up to 20 at a time, and revoking one takes effect immediately.

A token reads only the identity that created it. Give it to an agent the same way you would give it a password: as an environment variable or a client's own secret store, never pasted into a prompt or a shared file.

Connect a client

The production server is at https://mcp.linvesther.com/mcp, standard MCP over Streamable HTTP. If you run your own instance, point at its address instead — see Run it yourself.

Shell

claude mcp add --transport http linvesther https://mcp.linvesther.com/mcp \
  --header "Authorization: Bearer $TOKEN"

Any MCP client that speaks Streamable HTTP works the same way: send the token as Authorization: Bearer lvz_ro_… on every call. There is no configured fallback token, so a call sent without one is refused rather than answered with somebody else's account.

The six tools

Tool	Returns
`get_account_state`	Every connected account, each connection's health, each one's current value and their total.
`get_portfolio`	Positions held, their average cost, and profit since the account was connected — realized, unrealized and fees.
`get_nav`	What the account is worth right now, from its real balance and real market prices, and which assets make it up.
`get_performance`	CAGR, Sharpe, Sortino, maximum drawdown and win rate.
`get_trades`	The trades already collected for this account, filtered by market and period, paged.
`get_chart_series`	The account's value and time-weighted return over a range, as points for a chart.

Each tool publishes a JSON Schema for its input and its output, so a client can validate both without reading prose. A figure with too little history to compute comes back null with its own reason, never a zero standing in for it. Amounts cross as decimal strings, since a double cannot hold every value a balance can take.

What keeps this read-only

Nothing that writes is installed alongside it. The server ships as its own package, with no dependency on the code that connects an exchange, renames or removes an account, or starts a proof. There is no disabled write path to re-enable — the code simply is not there.
One credential, one purpose. A read-only token is checked by different code than your browser session, and neither can stand in for the other. It authorizes exactly the six reads above, is limited to 60 requests a minute per token, and stops working the moment you revoke it.
No silent fallback. Every call must carry its own token. A request sent without one is refused, never answered using some other configured identity.
Runs on its own. Each call gets its own server instance, closed when the call ends, so nothing from one identity's request can leak into another's. The listening address only accepts requests whose Host and Origin match an allowed hostname, which defends self-hosted instances against a browser page redirected at localhost.

Without MCP

The same six reads are also plain HTTP endpoints under /mcp/account/, authenticated the same way — see Public API if you would rather call them directly than through an MCP client.