Move get_instruments off the per-exchange Deribit router and onto the
unified interface, without losing the advanced Deribit filtering.
- /mcp/tools/get_instruments now accepts the Deribit-specific filters
(currency, kind, expiry_from/to, strike_min/max, min_open_interest) and
pagination (offset/limit). Venues that list everything (Hyperliquid)
ignore them. Response adds `meta: {deribit: {total, offset, limit,
has_more}}` surfacing per-source pagination.
- Remove /mcp-deribit/tools/get_instruments (endpoint + tool wrapper +
GetInstrumentsReq schema). The DeribitClient.get_instruments METHOD
stays — it's what the unified normalizer calls.
Tests: cover the enriched filters + meta passthrough; app-boot asserts
/mcp-deribit/tools/get_instruments is gone. Docs (API_REFERENCE/README/
CLAUDE) and smoke updated; also fixed the stale Hyperliquid tool count
(14 → 15) found during the doc check.
325 passed, ruff clean. Verified live: kind=option limit=5 → 5/940
has_more=true; /mcp-deribit/tools/get_instruments → 404.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Consolidate the cross-cutting data tools onto the unified interface and
remove their per-exchange duplicates.
- /mcp/tools/get_historical: single call, `exchange` now optional. Set →
that venue's candles (native symbol); omitted → cross-exchange consensus
(canonical symbol, median OHLC + div_pct). Folds in the former
/mcp-cross consensus, whose router is deleted.
- /mcp/tools/get_indicators: new common tool computing sma/rsi/atr/macd/adx
over the single-or-consensus series. Computation centralized in
common/indicators.py::compute_indicators (was duplicated per exchange).
- Remove get_historical from /mcp-deribit and /mcp-hyperliquid; remove
get_technical_indicators (deribit) and get_indicators (hyperliquid),
including the now-dead client methods, Req schemas and tool wrappers.
The client get_historical METHODS stay (used by the unified dispatch).
Tests: rewrite cross tests into test_unified (instruments, historical
single + consensus + failures, indicators single + consensus); drop the
old CrossClient test; tighten app-boot surface assertions (/mcp owns the
data tools; no /mcp-cross, no per-exchange historical/indicators).
Docs: API_REFERENCE / README / CLAUDE updated; smoke run_unified.sh now
covers consensus + indicators.
324 passed, ruff clean. Verified live against Deribit/Hyperliquid.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- README: three active exchanges (Deribit/Hyperliquid/IBKR); document the
unified /mcp interface (get_instruments uniform schema + per-exchange
get_historical); drop Bybit/Alpaca from endpoints, tool list, audit
filters, migration table and URL-override notes; update test count (323)
and source layout (routers/unified.py, old/).
- CLAUDE.md: new project guide — commands (uv/pytest/ruff/mypy), runtime
architecture, active exchanges, data interfaces, conventions.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add IBKR to the exchange list, endpoint table, audit filter values, and
Tool disponibili. Bump test count to 366 and reorder IBKR Setup before
Licenza.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
deploy-vps.sh: BRANCH default V2.0.0 invece di main.
README: clone con -b V2.0.0, nota che il branch in produzione è V2.0.0.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Il deploy ora avviene clonando il repo direttamente sul VPS, costruendo
l'immagine in loco e riavviando il container. Sostituisce il workflow
build & push verso registry + Watchtower.
Lo script automatizza:
- git fetch + reset --hard origin/<branch>
- docker compose build
- restart graceful (down 15s + up -d)
- attesa healthcheck con timeout configurabile
- rollback automatico al SHA precedente se /health fallisce
Variabili: BRANCH, PORT, HEALTH_TIMEOUT_SECONDS, FORCE, SKIP_ROLLBACK.
Rimosso scripts/build-push.sh (workflow registry abbandonato).
README aggiornato con la nuova procedura.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- /health/ready: ping di tutti i client (exchange, env) cached con
timeout 2s, status ready|degraded|not_ready, opt-in 503 via
READY_FAILS_ON_DEGRADED.
- Middleware mcp.request: 1 riga JSON per HTTP request con request_id,
method, path, status_code, duration_ms, actor, bot_tag, exchange,
tool, client_ip, user_agent.
- request_id propagato in request.state, audit log e error envelope per
correlazione cross-cutting.
- Aggiunto async health() come probe minimo a bybit/alpaca/macro/
sentiment/deribit (hyperliquid lo aveva già).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
README aggiunge sezione 'CI/CD pipeline' che descrive i 5 job e i tag
image. DEPLOYMENT espande sez. 1 con dettagli runner Gitea (network
gitea_gitea-internal, image runner-images, label ubuntu-latest) e
configurazione secret user-level REGISTRY_TOKEN con scope write:package.
CI pipeline (.gitea/workflows/ci.yml):
- Job lint (ruff), typecheck (mypy mcp_common gating + servizi
warn-only), test (pytest 455).
- Job build-and-push solo su main: builda gateway + 6 image MCP via
docker/build-push-action@v6, login al registry Gitea con
docker/login-action@v3 + secrets.GITEA_TOKEN auto-iniettato.
- Cache distribuita type=gha per layer Docker → run successivi 5-10x
più veloci. Tag :latest + :sha-XXXXXXX per ogni image.
Deploy VPS (docker-compose.prod.yml):
- Niente build locale: solo `image:` da git.tielogic.xyz/adriano/
cerbero-mcp/<service>:latest. Variabile IMAGE_TAG per pin a sha
specifico.
- Servizio Watchtower containerizzato che polla ogni 5min (configurabile
via WATCHTOWER_POLL_INTERVAL) e auto-aggiorna i container con label
com.centurylinklabs.watchtower.enable=true. Auth registry riusa
~/.docker/config.json bind-mounted readonly.
DEPLOYMENT.md: runbook completo per setup VPS, login registry, secrets,
.env, smoke test post-deploy, rollback (pin a sha), disable auto-update,
nota Traefik upload limit. README aggiornato con link.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Configura il gateway Caddy per il deploy su cerbero-mcp.tielogic.xyz:
- Build custom Caddy con plugin mholt/caddy-ratelimit (Dockerfile +
build via xcaddy).
- TLS automatico via Let's Encrypt (richiede DNS A record + porte
80/443 raggiungibili), HSTS preload, header di sicurezza.
- Rate limit per IP (60 req/min sui read, 10 req/min sui write,
sliding window).
- Allowlist IP sui write endpoint (place_*, cancel_*, set_*, close_*,
transfer_*, amend_*, switch_*): IP non in WRITE_ALLOWLIST → 403.
- Default WRITE_ALLOWLIST copre loopback + Docker bridge: bot sulla
stessa macchina (host o container) funziona senza configurazione,
IP pubblici esterni vanno aggiunti esplicitamente.
- Smoke test e README aggiornati per il nuovo URL gateway.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Deribit: private/create_combo + place_order sul combo instrument → una
sola crociata di spread invece di N (slippage atteso ridotto su
strutture liquide). ACL core + leverage cap su tutti i leg.
Bybit: place_batch_order su category=option (atomic multi-leg, 1
round-trip API). Reject su category != option (perp/linear non
supportano batch nativo). orderLinkId auto-generato per leg.
Tutti i test: deribit 48/48, bybit 123/123.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Documentata la precedenza di risoluzione environment e l'utilizzo dei
nuovi kwargs default_base_url_live/testnet di resolve_environment.
Smoke README estesa con i 6 live tool check read-only.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adriano