# Connect an AI Agent to TradeLock

**Doc version:** `1.0`

**Updated:** `2026-08-16`

The recommended TradeLock MCP setup uses the hosted Streamable HTTP endpoint and TradeLock sign-in. You do not need to create an API key or type an `Authorization` header.

## MCP URL

`https://tradelock-mcp.tradelock.workers.dev/mcp`

## Claude

1. Open **Customize → Connectors** in Claude or Claude Desktop.
2. Choose **Add custom connector**.
3. Name it `TradeLock` and paste the MCP URL.
4. Click **Connect**.
5. Sign in to TradeLock and choose **Allow access**.

No client ID or client secret is required.

## Codex

Add the MCP server in Codex settings, or place this in `config.toml`:

```toml
[mcp_servers.tradelock]
url = "https://tradelock-mcp.tradelock.workers.dev/mcp"
```

Run `codex mcp login tradelock` if authorization does not start automatically. Sign in to TradeLock and approve access.

Do not add `http_headers` for the normal OAuth setup.

## Hermes Agent

Add this to `~/.hermes/config.yaml`:

```yaml
mcp_servers:
  tradelock:
    url: https://tradelock-mcp.tradelock.workers.dev/mcp
    auth: oauth
```

Run:

```bash
hermes mcp test tradelock
```

Hermes opens the TradeLock authorization page on the first connection.

## Permissions

The MCP can read, create, and update forward-tracked strategies; submit trades and target portfolios; change strategy visibility; and archive strategies. It cannot route brokerage orders or rewrite historical trades.

OAuth access tokens expire after one hour. Refresh tokens rotate automatically and expire after 30 days. Disconnect or revoke TradeLock in the MCP client to end access.

## Static API-key fallback

Use this only when a client cannot complete OAuth. Create a dedicated full-scope key in TradeLock and send it as the standard HTTP header:

```http
Authorization: Bearer tlk_live_...
```

For Codex, the fallback is:

```toml
[mcp_servers.tradelock]
url = "https://tradelock-mcp.tradelock.workers.dev/mcp"
http_headers = { Authorization = "Bearer tlk_live_..." }
```

`Bearer` and the following space are standard HTTP authorization syntax; they are not part of the TradeLock key.

## Local stdio

Local stdio is an optional developer fallback for offline/private-network environments and older clients. Normal users do not need a local installer, Node.js, or a cloned TradeLock repository.