
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@pmxt/mcp
Advanced tools
MCP server that exposes the PMXT unified prediction market API as tools for Claude and other AI agents.
One tool per API method. Same interface regardless of venue -- Polymarket, Kalshi, Limitless, Probable, Baozi, Myriad, Opinion, Metaculus, Smarkets, and more.
Add to your Claude Desktop config (claude_desktop_config.json):
{
"mcpServers": {
"pmxt": {
"command": "npx",
"args": ["-y", "@pmxt/mcp"],
"env": {
"PMXT_API_KEY": "pmxt_live_..."
}
}
}
}
Or run directly:
PMXT_API_KEY=pmxt_live_... npx @pmxt/mcp
Get an API key at pmxt.dev/dashboard.
The MCP server doesn't run prediction market logic itself -- it forwards every tool call to a PMXT API server over HTTP. Where that server lives depends on the mode:
Hosted -- Set PMXT_API_KEY and the server calls https://api.pmxt.dev. No local setup required; the hosted service manages exchange connections, caching, and rate limits for you.
Local (sidecar) -- If no API key is set, the server assumes you're running the PMXT core server locally on http://localhost:3847. This is useful for development, self-hosting, or when you want full control over the runtime. See the pmxt core repo for how to run the server.
You can point at any PMXT-compatible server by setting PMXT_API_URL explicitly.
| Variable | Description |
|---|---|
PMXT_API_KEY | API key for the hosted PMXT service |
PMXT_API_URL | Override the API base URL (defaults based on mode) |
Every tool requires an exchange parameter (e.g. polymarket, kalshi, limitless). Read-only tools are safe to call freely. Order-related tools (createOrder, submitOrder, cancelOrder) require explicit user confirmation -- they spend real money.
Market discovery: fetchMarkets, fetchMarketsPaginated, fetchEvents, fetchEvent, fetchMarket
Order book & pricing: fetchOrderBook, fetchTrades, fetchOHLCV, getExecutionPrice, getExecutionPriceDetailed
Trading: buildOrder, createOrder, submitOrder, cancelOrder
Account: fetchBalance, fetchPositions, fetchOpenOrders, fetchClosedOrders, fetchAllOrders, fetchOrder, fetchMyTrades, loadMarkets
The server translates MCP tool calls into HTTP requests to the PMXT REST API:
fetchMarkets) with flat { exchange, limit, query } inputPOST /api/{exchange}/{method} with { args: [...] } to the PMXT APIThe tool definitions in src/generated/tools.ts are not hand-written. They are generated from the PMXT core OpenAPI spec by scripts/generate-tools.cjs.
The full pipeline runs automatically on every PMXT release:
v*) is pushed to the pmxt core reposync-mcp.yml GitHub Actions workflow triggersspec/:
core/src/server/openapi.yaml -- full API spec (endpoints, parameters, response schemas)core/src/server/method-verbs.json -- HTTP verb and positional argument metadata per methodnode scripts/generate-tools.cjs to regenerate src/generated/tools.tspackage.json to match the core versionnpm publish --provenance --access publicWhat the generator does:
watchOrderBook, close, healthCheck, etc.)ArgSpec metadata so the server can reconstruct positional args at runtimereadOnlyHint, destructiveHint, idempotentHint) per toolcredentials input propertyTo regenerate locally:
npm run generate
npm install
npm run generate # regenerate tools from spec/
npm run build # compile TypeScript
MIT
FAQs
MCP server for PMXT - the unified prediction market API
The npm package @pmxt/mcp receives a total of 8,700 weekly downloads. As such, @pmxt/mcp popularity was classified as popular.
We found that @pmxt/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.