Connect an AI Agent to TradeLock

Doc version: 1.0

Updated: 2026-08-23

The recommended TradeLock MCP setup uses the hosted Streamable HTTP endpoint and TradeLock sign-in. You do not need to create an API key or type an Authorization header.

MCP URL

https://tradelock-mcp.tradelock.workers.dev/mcp

Claude

Open Customize → Connectors in Claude or Claude Desktop.
Choose Add custom connector.
Name it TradeLock and paste the MCP URL.
Click Connect.
Sign in to TradeLock and choose Allow access.

No client ID or client secret is required.

Codex

Add the MCP server in Codex settings, or place this in config.toml:

toml

[mcp_servers.tradelock]
url = "https://tradelock-mcp.tradelock.workers.dev/mcp"

Run codex mcp login tradelock if authorization does not start automatically. Sign in to TradeLock and approve access.

Do not add http_headers for the normal OAuth setup.

Hermes Agent

Add this to ~/.hermes/config.yaml:

yaml

mcp_servers:
  tradelock:
    url: https://tradelock-mcp.tradelock.workers.dev/mcp
    auth: oauth

Run:

bash

hermes mcp test tradelock

Hermes opens the TradeLock authorization page on the first connection.

Permissions

The MCP can read, create, and update forward-tracked strategies; submit trades and target portfolios; change strategy visibility; and archive strategies. It cannot route brokerage orders or rewrite historical trades.

OAuth access tokens expire after one hour. Refresh tokens rotate automatically and expire after 30 days. Disconnect or revoke TradeLock in the MCP client to end access.

Headless bearer-token fallback

Use this only when a headless client cannot complete browser OAuth. Create a dedicated full-scope API key in TradeLock and send it as the standard HTTP header:

http

Authorization: Bearer tlk_live_...

Generic JSON configuration (if your MCP client supports environment-variable interpolation) is:

json

{
  "mcpServers": {
    "tradelock": {
      "url": "https://tradelock-mcp.tradelock.workers.dev/mcp",
      "headers": {
        "Authorization": "Bearer ${TRADELOCK_API_KEY}"
      }
    }
  }
}

For a direct headless smoke test, inject the key without putting it in shell history. In CI, populate the variable from the platform secret manager:

bash

read -r -s TRADELOCK_API_KEY
export TRADELOCK_API_KEY
curl --fail-with-body -sS \
  -H "Authorization: Bearer ${TRADELOCK_API_KEY}" \
  -H 'Accept: application/json, text/event-stream' \
  -H 'Content-Type: application/json' \
  --data '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"headless-check","version":"1.0"}}}' \
  https://tradelock-mcp.tradelock.workers.dev/mcp

For Codex, the fallback is:

toml

[mcp_servers.tradelock]
url = "https://tradelock-mcp.tradelock.workers.dev/mcp"
http_headers = { Authorization = "Bearer ${TRADELOCK_API_KEY}" }

Use a client-supported environment-variable reference or secret injection mechanism; do not commit the key, put it in a prompt, or paste it into a shared config. Bearer and the following space are standard HTTP authorization syntax; they are not part of the TradeLock key.

Local stdio

Local stdio is an optional developer fallback for offline/private-network environments and older clients. Normal users do not need a local installer, Node.js, or a cloned TradeLock repository.