Market data needs nothing at all, so an assistant can read tickers and order books before any key exists. Everything else runs under a Kraken key whose permissions the server checks first, behind a bearer token you mint and can revoke — so the key's permission set is where you decide what an agent may do, and a read-only key genuinely stays read-only. The author labels it alpha and asks you to start against one.
An MCP server over Kraken's Spot REST API, served over HTTP and gated by bearer tokens you mint locally. Market-data calls need no Kraken credentials at all; anything touching an account runs under the key you supply, and the server checks that key's permissions before a call leaves the machine.
- Public market data with no Kraken credentials — `get_ticker`, `get_ohlc`, `get_order_book`, `get_recent_trades`, `get_recent_spreads`, `get_assets`, `get_asset_pairs`, `get_system_status`
- Account reads: balances, trade volume, ledgers and export reports — `get_account_balance`, `get_extended_balance`, `get_trade_balance`, `get_trade_volume`, `get_ledgers`, `request_export_report`
- Trading: open and closed orders, trade history, positions, and placing, amending and cancelling orders — `get_open_orders`, `get_trade_history`, `get_open_positions`, `add_order`, `amend_order`, `cancel_order`, `cancel_all_orders_after`
- Funding and Earn: deposit and withdrawal methods, addresses and status, wallet transfers and strategy allocation — `get_deposit_addresses`, `get_withdrawal_info`, `withdraw`, `wallet_transfer`, `list_earn_strategies`, `allocate_earn`
- Permission checking ahead of the call: the key is introspected once via `GetAPIKeyInfo`, and a call the key cannot perform is rejected with `KrakenPermissionError` naming the flags it would need
- A `GET /health` endpoint that answers without a bearer token, for container and load-balancer checks
Python `>=3.12` and `uv`. Clone, `uv sync --dev`, and put `KRAKEN_API_KEY` and `KRAKEN_API_SECRET` in `.env` for anything beyond public market data. Mint a client token with `uv run mcp-kraken token create` — the plaintext is printed once and only its SHA-256 hash is stored. `uv run mcp-kraken serve` listens on `0.0.0.0:8765/mcp`; clients authenticate with an `Authorization: Bearer` header, or with `?apikey=` when they cannot set headers. `uv run mcp-kraken serve --stdio` drops the HTTP and bearer layers for local use. Host, port, path, token database and TLS files are all environment-configurable.
One command plus a key — uvx mcp-kraken, then supply credentials