MCP.Market

Alpaca Guard MCP server

by evidai·io.github.evidai/alpaca-guard·v0.1.1·3 stars
No reviews yet

Alpaca trading API with hard daily USD cap guard. Paper trading default; live opt-in.

B72/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B72/100

full report

Adoption
New

3 stars

Reviews

Write one

Nobody has reviewed Alpaca Guard yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Alpaca Guard tools (7)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • get_account

    Alpaca account snapshot (buying power, cash, equity, portfolio value, PDT flag). Read-only.

  • get_latest_quote

    Latest bid/ask/mid quote for a given symbol from Alpaca's market-data API. Read-only.

  • get_positions

    Current open positions on Alpaca (symbol, qty, avg entry price, current price, unrealized P&L). Read-only.

  • guard_set_limit

    Set the daily USD cap. The agent cannot raise its own cap silently — calling this tool is logged in the ledger. Typical use: human operator runs this once to set the daily limit (default $10) before letting the agent loose.

  • guard_status

    Return today's spend ledger: daily limit, used so far, remaining, lifetime order count, and recent 10 orders. Read-only.

  • guarded_close_position

    Close a position on Alpaca. Pre-flighted against the daily cap: if closing requires re-opening exposure (short close → re-buy) that exceeds the cap, refuses.

  • setup

    Show alpaca-guard-mcp setup status: env vars, paper/live mode, current daily cap, and ledger file location. Read-only.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings
  • Code scan11 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 102 days ago8/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 72/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Alpaca Guard compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
72/100
higher than 38% of 48,255 servers
Tools
7
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
3
more than 80% of 28,688 servers

What its tools let an agent do: 6 read · 1 change

Install Alpaca Guard in Claude Code, Cursor or VS Code

Runs npx -y alpaca-guard-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add alpaca-guard -- npx -y alpaca-guard-mcp
Add to Cursor

What the publisher says

From the Alpaca Guard repository's README, as published. We do not edit it. Read it on GitHub

🍋 LemonCake

The billing, budget & identity layer for software for agents. Private Beta · Open core

Monetize any MCP/API in minutes, and let AI agents pay for it safely — each agent gets a spend-capped identity (budget, usage, pause/revoke). Buyers pay by card; no crypto wallet. First 3,000 calls free (lifetime). Then 3% only when your API earns.

-green.svg)

🚀 Get started · 💲 Pricing · 📚 Docs · 🌐 Live

☝️ A real AI agent buys API calls by itself ($0.01 each), stops at its cap, and the API owner earns — no human, no crypto. · demo source

🚀 Get started

Monetizing an MCP/API? Start here — one command:

npx create-lemon-mcp my-paid-mcp     # a paid MCP server, running in sandbox now
# then add a Seller Key in /app and set LEMONCAKE_SELLER_KEY → it charges for real (no code change)

Pick your path:

Buyer-side MCP — try in 30 seconds

npx -y agent-payment-mcp
{ "mcpServers": { "lemon": { "command": "npx", "args": ["-y", "agent-payment-mcp"] } } }

Ask your agent to run listdemos / calldemo. To call paid APIs, set LCPAYTOKEN (get one at lemoncake.xyz/app).

What is LemonCake?

LemonCake is an x402 payment rail for monetizing MCP servers and HTTP APIs. Sellers register an endpoint and set a price per call. Buyers prepay by card and receive a spend-capped Pay Token. Agents call the gateway with that token, and LemonCake verifies, meters, forwards, and records usage.

sequenceDiagram
    participant A as 🤖 AI Agent
    participant G as 🍋 LemonCake Gateway
    participant API as Your API
    A->>G: POST /g/:id (no token)
    G-->>A: 402 + accepts[] (price, mintUrl)
    A->>G: mint Pay Token (off-session, capped)
    A->>G: Bearer :jwt
    G->>API: forward (upstream key hidden)
    API-->>A: 200 + result
    Note over A,G: budget exhausted → 402 → agent self-funds → continues

Sellers register any HTTP API and set a price per call. Buyers / agents prepay with a card → Pay Token issued automatically → agent calls the API within budget. Budget exhausted → 402 challenge → agent self-funds → continues. No humans.

🧱 Open core

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Alpaca Guard: common questions

Is Alpaca Guard MCP server safe?
Mostly: it is graded B (72/100). Read the Alpaca Guard safety report
How do I install Alpaca Guard?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Alpaca Guard need an API key?
Yes. The registry entry asks for ALPACA_API_KEY, ALPACA_SECRET_KEY.
Is Alpaca Guard maintained?
The last commit was 140 days ago (2026-06-17). The latest release is v0.1.1.
How does Alpaca Guard compare with other MCP servers?
safety score 72/100 (higher than 38% of 48,255 servers); tools 7 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

More from evidai →