Prediction Market Tools with an MCP Server

What the flag on these cards means

interfaces.mcp_server says one thing: the vendor publishes a Model Context Protocol server for this product. An MCP server is a process, or an endpoint, that describes the product to an agent client as a list of named tools with typed arguments — so a model can call get_market or place_paper_order the way it would call a function, without you writing a client first.

That is a packaging fact, not a quality one. It says the data you could already have fetched over REST is now reachable by something that decides for itself which call to make next, and — on a minority of these cards — that some of those calls change state. Nothing else about the product follows from it.

The distinction worth holding on to is that the agent is not reading a page. It is being handed a capability list by the vendor, and it will use what is on that list. What is on the list is therefore the whole of the security question, and it is printed by the server itself.

Read, prepare, write — three things behind one word

Most of this listing is read-only. Adjacent exposes four tools — list, find, get and price. Dune exposes table discovery, search by contract address, saved queries, query execution, results and credit usage. Orcalayer pipes whale trades and wallet metrics into a client. Depthfeed returned fifteen tools to an unauthenticated tools/list call on 19 September 2026 — search, order books, snapshots and candles across three venues, plus bars, backtest_paths, a screener and whoami. An agent given any of these can be wrong about your research; it cannot be wrong about your balance.

Two cards sit in the middle, and this is the shape to prefer. Polyrama exposes ten tools and exactly one of them writes: place_paper_order. Its API's write:live scope is documented as reserved for future live trading, so the answer to "can the agent trade" is no, in a way you can check rather than trust. Limitless does the other version of the same idea — its first-party server searches markets, reads books and price history, and prepares orders that a human then approves in the browser. It is non-custodial and holds no keys at all.

A few go all the way to the exchange, and they all make you ask twice. CCXT ships ccxt-mcp, run locally over stdio, which exposes market data, balances and opt-in trading; trading, withdrawals and raw endpoints are separate opt-in tiers and are off by default. Predictefy publishes the most explicit inventory in the catalogue: 42 tools by default, of which 33 are read, intelligence and platform tools and 9 are paper-trading tools, with a further 10 execution and collateral tools that do not appear at all unless MCP_ENABLE_TRADE is set. No single tool both builds and submits an order, new keys are read-only until a trade scope is added, and spend caps default to 100 US dollars per order and 1,000 per key per rolling 24 hours. Myriad runs its server from a first-party CLI for agent-driven trading, and PMXT hands @pmxt/mcp the venue-native credentials — a Polygon private key for Polymarket, an API key plus an RSA private key for Kalshi.

On the on-chain venues that last point is the whole of it: the key that signs an order is the key that moves the collateral. There is no read-only version of it to hand over.

Where the key lives

Three arrangements, and they fail differently.

• Local process, key in the environment. npx predexon-mcp with the key in an environment variable (Predexon), npx -y @predictefy/mcp, CCXT over stdio with the keys never leaving the machine. The exposure is your machine and whatever else runs on it.
• Hosted endpoint, key over the wire. FinFeedAPI takes it in an X-APIKey header; Adjacent takes it as an apiKey query parameter for the realtime tier — and a credential in a query string is a credential in somebody's access log. Polymarket Analytics is the same shape with a bearer token, and Apify's host at least fails honestly, answering an unauthenticated request with a 401 rather than a 404.
• Your account, not a key at all. Dune's server authenticates over OAuth against your Dune account and draws on the same credit allowance as everything else you run there. There is no narrower thing to hand it, and an agent that loops costs you credits rather than a rate-limit error.

What to ask before you connect one

1. What does it export? Call tools/list and read it. It takes a minute, several of these answer it with no key, and it is the only description of the server that cannot be out of date.
2. Which of those tools write, and what does a write mean here? A simulated fill, an order parked for a human to approve, or a signed order against real collateral are three different answers, and the tool name usually says which — place_paper_order is not ambiguous.
3. Where does the credential sit, and how narrow can it be made? Environment variable in a local process, header to a vendor's host, or an OAuth session over a whole account. Ask whether a read-only key exists, whether trading is a separate scope, and whether there is a spend cap. Predictefy answers all three in its own documentation; most do not.

What the flag does not tell you

It is not a claim about the data. It is not a claim about the licence: Polyrama's MCP server is MIT-licensed and published as @polyrama/mcp, while the terminal and the API behind it are not open source, and the server needs a Polyrama token to be useful at all. It is not a claim about stability — Predictefy's SDK, CLI and MCP packages are all on beta lines and its own documentation says to pin an exact version rather than track latest, and PMXT's last release was 18 July 2026. And it is not a claim that the product is free: Artemis carries REST, MCP and a Snowflake share together on the tier its documentation prices from 50,000 US dollars a year.

It is also the fastest-moving field on any of these cards. A server that exposed four read tools in September can expose a write one in November without the product changing its name, which is the reason step 1 above is "ask the server" and not "read this page".

Nothing in this collection has been connected to a funded account by this site. The tool inventories, the scopes and the defaults above are read from vendor documentation and from unauthenticated protocol calls, both dated on the cards.