Learn / Exchange & Broker MCP

Bybit MCP server setup

Figures on this page are as of 2026-09. Fees, limits and margin tiers change — check the venue's own docs before acting on a number.

We found no official Bybit MCP server. What exists is community code — and one of those projects, dlwjdtn535/mcp-bybit-server, has the best safety defaults of any exchange MCP server reviewed here, which makes it worth describing in detail as a picture of what good looks like.

That is a recommendation about a design pattern, not an endorsement. We have not audited the code, and you should read the current README before installing anything that holds your keys.

The defaults worth copying

TRADING_ENABLED      default: false
READONLY_MODE        default: false
MAX_ORDER_SIZE_USDT  default: 100
TESTNET              default: false

TRADING_ENABLED=false by default. Mutating tools are blocked until you explicitly turn them on. A fresh install cannot trade, and enabling it is a deliberate act rather than something you get by not thinking about it.

READONLY_MODE=true hard-blocks every mutating tool regardless of other settings. A second, stronger switch that does not depend on getting the first one right.

MAX_ORDER_SIZE_USDT caps estimated order notional at 100 by default. Even with trading enabled, a decimal-place error is rejected rather than filled. This is a limit enforced in code, inside the server, before the request goes out — exactly the shape argued for in why MCP needs an approval layer.

The README is direct about why: “This server can place real trades with real money.”

Contrast this with the Binance community server, which is trading-enabled by default with no documented disable mechanism. Two servers, two venues, the same category of software, opposite postures. You cannot assume this from the category.

Install

# from source
uv sync
uv run mcp-bybit-server

# or via Smithery
npx -y @smithery/cli install @dlwjdtn535/mcp-bybit-server --client claude

Python 3.12+. Docker is also documented.

Credentials:

ACCESS_KEY   # Bybit API key
SECRET_KEY   # Bybit API secret

The README states API keys are never logged or exposed, and advises: “Never commit your API keys. Provide them through environment variables only.” Worth verifying yourself with a debug run against testnet credentials — see where an MCP server keeps your API keys.

Tools exposed

Market data — order book, candlesticks, tickers, trade history, instrument metadata, funding rates, open interest, fee rates, server time, snapshots.

Account — wallet balances, positions, order history, open orders, API key info.

Trading (mutating, gated) — validate orders, place / amend / cancel, set stops, margin and leverage.

The validate order tool is a nice touch: it lets the model check an order without submitting one.

A read-only alternative

sammcj/bybit-mcp is read-only by construction and self-describes as alpha quality, recommending you only ever point a read-only API key at it.

Read-only by construction is a stronger property than read-only by configuration, because there is no setting to get wrong. The same reasoning makes 0xmichalis/ibkr-flex-mcp the interesting option on the IBKR side.

Layer it against the key

Every control above lives inside the server. They are good controls and they are configured by you, in the component you are trying to bound.

The layer that holds regardless is the Bybit API key. Its scopes are enforced by Bybit, not by your machine:

  1. Read-only key first. Permission failures then surface as 10005, “Permission denied, please check your API key permissions.”
  2. Bind an IP. Enforced — 10010 is “Unmatched IP, please check your API key’s bound IP addresses.”
  3. TESTNET=true while learning. Bybit’s testnet is a separate hostname (api-testnet.bybit.com), so credentials simply do not exist on mainnet — an environment mistake fails with an auth error rather than a live order. See Bybit testnet setup.

The account-type trap

Bybit changes what several error codes mean depending on whether you are on a Unified Trading Account, and this catches people debugging an MCP setup:

  • 10003 — “too many sessions under the same UID” on classic accounts; “your api key has expired” under UTA on spot.
  • 33004 — the UTA derivatives expired-key code.
  • 110028 / 100028 — near-mirror codes telling you which account type you have.

If your server starts failing authentication after working, check Bybit API error 10003 before assuming the server broke.

Also note HTTP 403 is documented for US IPs, alongside IP rate-limit breaches and GET requests with an empty JSON body — three unrelated causes, one status code.

FAQ

Is there an official Bybit MCP server?

We did not find one — what is available is community code. That means we did not find one rather than that none exists, so check Bybit’s own documentation before concluding. Among the community projects, dlwjdtn535/mcp-bybit-server stands out for shipping trading disabled by default.

How do I stop an MCP server from placing Bybit orders?

Two independent layers. In that server, leave TRADING_ENABLED at its default of false, or set READONLY_MODE=true to hard-block mutations regardless of other settings. Separately and more importantly, use a Bybit API key without trade permission — that boundary is enforced by Bybit rather than by software running on your machine.

What does MAX_ORDER_SIZE_USDT do?

It caps the estimated notional of an order at 100 USDT by default, so an order larger than that is rejected inside the server before reaching Bybit. It is the kind of control that catches a decimal-place error, which is the most common way an AI-drafted order goes wrong.

Should I use testnet first?

Yes, and the server supports it with TESTNET=true. Bybit’s testnet is a separate hostname with separate credentials, so pointing at the wrong environment produces an authentication error rather than a real trade — which makes it a safe place to find your parameter mistakes.