feat(mcp-deribit,mcp-bybit): add place_combo_order

Deribit: private/create_combo + place_order sul combo instrument → una
sola crociata di spread invece di N (slippage atteso ridotto su
strutture liquide). ACL core + leverage cap su tutti i leg.

Bybit: place_batch_order su category=option (atomic multi-leg, 1
round-trip API). Reject su category != option (perp/linear non
supportano batch nativo). orderLinkId auto-generato per leg.

Tutti i test: deribit 48/48, bybit 123/123.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

services/mcp-deribit/tests/test_client.py

@@ -221,6 +221,67 @@ async def test_get_dvol(httpx_mock: HTTPXMock, client: DeribitClient):
     assert result["candles"][0]["close"] == 57.0
 
 
+@pytest.mark.asyncio
+async def test_place_combo_order(httpx_mock: HTTPXMock, client: DeribitClient):
+    httpx_mock.add_response(
+        url=re.compile(r"https://test\.deribit\.com/api/v2/public/auth"),
+        json=AUTH_RESP,
+    )
+    httpx_mock.add_response(
+        url=re.compile(r"https://test\.deribit\.com/api/v2/private/create_combo"),
+        json={
+            "result": {
+                "id": "BTC-COMBO-1",
+                "instrument_name": "BTC-COMBO-1",
+                "state": "active",
+            }
+        },
+    )
+    httpx_mock.add_response(
+        url=re.compile(r"https://test\.deribit\.com/api/v2/private/buy"),
+        json={
+            "result": {
+                "order": {"order_id": "ord-1", "order_state": "open"},
+                "trades": [],
+            }
+        },
+    )
+    legs = [
+        {"instrument_name": "BTC-30APR26-75000-C", "direction": "buy", "ratio": 1},
+        {"instrument_name": "BTC-30APR26-80000-C", "direction": "sell", "ratio": 1},
+    ]
+    result = await client.place_combo_order(
+        legs=legs,
+        side="buy",
+        amount=1,
+        type="limit",
+        price=0.05,
+        label="vert-spread",
+    )
+    assert result["combo_instrument"] == "BTC-COMBO-1"
+    assert result["order"]["order_id"] == "ord-1"
+
+
+@pytest.mark.asyncio
+async def test_place_combo_order_create_combo_error(httpx_mock: HTTPXMock, client: DeribitClient):
+    httpx_mock.add_response(
+        url=re.compile(r"https://test\.deribit\.com/api/v2/public/auth"),
+        json=AUTH_RESP,
+    )
+    httpx_mock.add_response(
+        url=re.compile(r"https://test\.deribit\.com/api/v2/private/create_combo"),
+        json={"error": {"code": -32602, "message": "Invalid leg"}},
+    )
+    result = await client.place_combo_order(
+        legs=[{"instrument_name": "BTC-X", "direction": "buy", "ratio": 1}],
+        side="buy",
+        amount=1,
+        type="market",
+    )
+    assert result["state"] == "error"
+    assert "Invalid leg" in str(result.get("error"))
+
+
 @pytest.mark.asyncio
 async def test_cancel_order(httpx_mock: HTTPXMock, client: DeribitClient):
     httpx_mock.add_response(

services/mcp-deribit/tests/test_server_acl.py

@@ -20,6 +20,7 @@ def mock_client():
     c.get_historical = AsyncMock(return_value={"candles": []})
     c.get_technical_indicators = AsyncMock(return_value={"rsi": 55.0})
     c.place_order = AsyncMock(return_value={"order_id": "x"})
+    c.place_combo_order = AsyncMock(return_value={"combo_instrument": "BTC-COMBO-1", "order": {"order_id": "x"}})
     c.cancel_order = AsyncMock(return_value={"order_id": "x", "state": "cancelled"})
     c.set_stop_loss = AsyncMock(return_value={"order_id": "x", "stop_price": 45000})
     c.set_take_profit = AsyncMock(return_value={"order_id": "x", "tp_price": 55000})
@@ -94,6 +95,73 @@ def test_place_order_observer_forbidden(http):
     assert r.status_code == 403
 
 
+def test_place_combo_order_core_ok(http):
+    r = http.post(
+        "/tools/place_combo_order",
+        headers={"Authorization": "Bearer ct"},
+        json={
+            "legs": [
+                {"instrument_name": "BTC-30APR26-75000-C", "direction": "buy", "ratio": 1},
+                {"instrument_name": "BTC-30APR26-80000-C", "direction": "sell", "ratio": 1},
+            ],
+            "side": "buy",
+            "amount": 1,
+            "type": "limit",
+            "price": 0.05,
+        },
+    )
+    assert r.status_code == 200
+    assert r.json()["combo_instrument"] == "BTC-COMBO-1"
+
+
+def test_place_combo_order_observer_forbidden(http):
+    r = http.post(
+        "/tools/place_combo_order",
+        headers={"Authorization": "Bearer ot"},
+        json={
+            "legs": [
+                {"instrument_name": "BTC-X", "direction": "buy", "ratio": 1},
+                {"instrument_name": "BTC-Y", "direction": "sell", "ratio": 1},
+            ],
+            "side": "buy",
+            "amount": 1,
+        },
+    )
+    assert r.status_code == 403
+
+
+def test_place_combo_order_min_legs(http):
+    r = http.post(
+        "/tools/place_combo_order",
+        headers={"Authorization": "Bearer ct"},
+        json={
+            "legs": [{"instrument_name": "BTC-X", "direction": "buy", "ratio": 1}],
+            "side": "buy",
+            "amount": 1,
+        },
+    )
+    assert r.status_code == 422
+
+
+def test_place_combo_order_leverage_cap_enforced(http):
+    r = http.post(
+        "/tools/place_combo_order",
+        headers={"Authorization": "Bearer ct"},
+        json={
+            "legs": [
+                {"instrument_name": "BTC-X", "direction": "buy", "ratio": 1},
+                {"instrument_name": "BTC-Y", "direction": "sell", "ratio": 1},
+            ],
+            "side": "buy",
+            "amount": 1,
+            "leverage": 50,
+        },
+    )
+    assert r.status_code == 403
+    err = r.json()["error"]
+    assert err["code"] == "LEVERAGE_CAP_EXCEEDED"
+
+
 def test_place_order_leverage_cap_enforced(http):
     """Reject leverage > max_leverage (da secret, default 3)."""
     r = http.post(