
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@marketmaster/mcp
Advanced tools
MCP server for the MarketMaster prediction-market data API — use live edges, arbitrage, and whale data inside Claude and Cursor.
MCP server for the MarketMaster prediction-market data API. Pull live edges, arbitrage spreads, market snapshots, and the whale feed (Kalshi and Polymarket) straight into Claude or Cursor.
Hosted — nothing to install. Paste this URL into any MCP client that supports remote servers (Claude, Cursor, and anything else speaking streamable-http):
https://api.marketmaster.live/mcp
It authenticates with OAuth 2.1 (PKCE, dynamic client registration), so there is no key to paste and nothing to keep up to date.
This package — stdio, for clients that want a local process. Covered below.
mm_edges — mispriced edges, rankedmm_markets — latest market snapshotsmm_market — one market + its edgesmm_arbitrage — cross-platform spreadsmm_whales — large real-money tradesmm_status — your tier, limits, usageGet an API key at https://marketmaster.live/dashboard (looks like mmk_live_...).
Add to claude_desktop_config.json:
{
"mcpServers": {
"marketmaster": {
"command": "npx",
"args": ["-y", "@marketmaster/mcp"],
"env": { "MARKETMASTER_API_KEY": "mmk_live_your_key" }
}
}
}
Add to ~/.cursor/mcp.json (same shape as above), then enable it in Settings → MCP.
"Use MarketMaster to find the 5 biggest Kalshi edges right now." "Any cross-platform arbitrage over 3%?" "Show recent whale trades over $25k."
Read-only — never places trades or touches funds. Full API docs: https://marketmaster.live/developers
The MCP server wraps a plain REST API. To check a key works before wiring anything up:
curl "https://api.marketmaster.live/v1/edges?limit=5" -H "x-api-key: mmk_live_your_key"
Note for Python: the stdlib urllib default user agent is blocked by the CDN in
front of the API (you get a 403 HTML page, not JSON). requests, httpx and the
official SDK all work, as does urllib with any custom User-Agent set.
edge_pct is gross. edge_after_fees is what survives venue fees, and the two
routinely differ by more than the edge itself.settlement_risk: "divergent" means the two venues resolve the same question on
different dates. That is not arbitrage, however good the spread looks.FAQs
MCP server for the MarketMaster prediction-market data API — use live edges, arbitrage, and whale data inside Claude and Cursor.
We found that @marketmaster/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.