Vealth MCP server for GMX v2, live — try it yourself, no signup

Feature Discussion
1

GMX v2 MCP server, live — try it yourself, no signup

brawlaphant here (EcoWealth / Vealth).

GMX’s own AI Agents docs say the official MCP server is “under development and not yet available.”

So we built one and put it live.

Try it right now — no signup, no key:

curl -X POST https://vealth.net/mcp \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"gmx_get_prices","arguments":{}}}'

That’s a real call against live GMX v2 Arbitrum oracle prices right now.

Point any MCP client at Connect your AI · Vealth .

The tools show up in tools/list alongside our other public tools.

Five tools:

  • gmx_get_positions

  • gmx_get_orders

  • gmx_get_prices

Read-only and free.

  • prepare_gmx_order

  • submit_gmx_order

Non-custodial. We return unsigned transaction data, you sign with your own wallet, and we relay the already-signed transaction.

We never hold or ask for a private key.

Built directly against the documented contracts, not the official @gmx-io/sdk — that pulls in react-native transitively with real HIGH-severity vulnerabilities, an avoidable risk for a production trading backend.

Zero new dependencies here.

Repo’s private for now. Happy to open-source the tool itself or hand it to whoever’s picking up the official MCP work.

No ask attached — it’s live either way.

— brawlaphant / EcoWealth

2

Follow-up to yesterday’s MCP post. Everything below now lives in one place, written specifically for this team:

The server is still answering. Five GMX v2 tools, non-custodial, free to call, no API key:

curl -X POST https://vealth.net/mcp \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"gmx_get_prices","arguments":{}}}'

Reads are open: positions, orders, and oracle prices for any wallet.

Writes are prepare-unsigned: you sign, we relay the signed transaction. We never see a key. Entries are bounded to mark ±2%, with test coverage on the bound.

One concrete SDK issue worth someone’s afternoon:

A clean install of @gmx-io/sdk@1.6.4 resolves 304 packages, and npm audit returns 16 findings, including 7 HIGH.

The entire HIGH chain exists to supply a performance.now() polyfill:

@gmx-io/sdk → isomorphic-performance → react-native-performance → react-native → metro tooling → image-size

Relevant advisories:

GHSA-w3rx-r6r6-pgpr
GHSA-5p2g-fcmc-qvqq

Both are CVSS 7.5.

Any org gating CI on npm audit fails the moment it installs the official SDK. Replacing the isomorphic-performance branch is a one-dependency swap. Happy to file the reproducible issue on the repo if useful.

The site above carries the rest: seven findings with a source on every claim, the live demo, the full tool schemas, and the strengths the same reading found, because there were plenty.

Each page’s hash is anchored on Base through our public proof ledger, so what you read cannot quietly change afterward.

We would genuinely like feedback on this.

If you use the server, tell us what is missing. If a finding is wrong, say so on this thread and we will correct it and note the correction.

If the useful move is open-sourcing the tool or handing it to whoever picks up the official MCP work, one reply here starts it.

3

Hey @brawlaphant, very interesting would love to talk more about it. Can you dm me on Tg: @saurabhd1