Open-Source Prediction Market Tools

What this collection selects

access.open_source is a claim about the thing on the card: its own source is published under a licence anyone can read. That is all it asserts. It is not a claim that the product is free, that it is maintained, that it can be self-hosted, or that anyone has audited it.

Three facts hide behind the phrase, and they come apart constantly.

A licence, an open repository, and which part is open

The licence says what you may do. Most of this listing is MIT. Confido is AGPL-3.0, and that is the one worth reading before you plan anything: it reaches code run as a network service for other people, which is precisely what a self-hosted forecasting workspace is. Metaculus is BSD-2-Clause, the alpha bot is Apache-2.0.

An open repository says whether you can participate. The two are independent, and the cleanest demonstration in the catalogue is a card that is not in this collection: kalshi-python is the exchange's own package, its wheel declares its licence as LicenseRef-Proprietary, and the repository its metadata names returns 404 to anyone outside the company. You can install it and read the generated Python inside the wheel. You cannot see its history, file an issue against it, or send a patch. Readable code, closed project.

And there is the question of which part is open. FinFeedAPI publishes MIT-licensed generated SDKs covering a dozen languages, while the data and the service behind them are paid and hosted — the SDK being open source does not make the service open source. Polyrama is the same shape from the other end: its MCP server is MIT, its terminal and API are not. Neither card is in this collection, because the flag is about the product the card is for.

Open source at a client is not open source at a platform

Both kinds are in this listing and they answer different questions.

At a client, it is a question about your machine. py-clob-client, polymarket-client, pykalshi, the Limitless SDK, CCXT and PMXT all run in your process, holding your credential. Open source means you can answer three things yourself: what the code does with the key, what it pulls in alongside it, and whether you can fork it when the vendor stops. That third one is not hypothetical here — see the archived card below.

At a platform, it is a question about the house rules. Manifold publishes the code its own site runs on, which is why its fee position is a fact rather than a promise: the taker fee constant and the flat trade fee in that code are both zero. The Manifold API and Metaculus are the same situation. What none of them gives you is the thing that matters most about a platform — the balances, the users, the questions and the resolutions all live on a server you do not run. Metaculus makes the limit vivid: since 2026 every API request needs an account token, and the licence on the source had nothing to say about that.

The sharpest case is brier-fyi, which scores four venues against each other. It is MIT, and the code is why anyone can state what is wrong with it: the last commit is dated 24 January 2026 and the one before it is titled "infra, pause nightly data pipeline". The site is up and the numbers are not moving. A closed product in that state would simply look stale.

What to check, in the order it goes wrong

• Is it archived, and does the README say anything? py-clob-client is MIT, archived, and carries Polymarket's own notice that it no longer works and should not be used. This is the official SDK for the largest venue in the catalogue, and its licence is unchanged and irrelevant. The replacement is polymarket-client.
• Do the releases and the commits agree? polymarket-us-python has exactly two PyPI releases, 0.1.1 and 0.1.2, both uploaded on 22 January 2026, with no tags or GitHub releases since, while main took a retry and correlation-id change in June 2026 and an order-snapshot subscription fix in September — so what you read on GitHub is not what pip install gives you, and the card's advice is to install from git if you need the fixes. The Limitless SDK is the opposite and the standard to hold the rest to: version 1.1.1 on 17 September 2026, which is also the date of its last commit.
• Does an open issue tracker actually tell you anything? PMXT shipped 322 releases between January and July 2026 and then stopped; it is not archived and its tracker is open, with 1,236 open issues and 77 open pull requests counted on 19 September 2026. An open tracker that large cannot tell you whether your problem is already known, which is the only thing anybody opens a tracker for.

What happens to your keys in code you run yourself

This is the sentence the collection exists to print, and it is the same one the clients and bots category page makes: an MIT licence is permission to read the code, not evidence that anyone did.

What that means in practice, from cards in this listing:

• Prefer a library that separates reading from trading. polymarket-client splits it in the type system: its public clients need no credentials at all, while SecureClient and AsyncSecureClient take a local private key and can trade. A notebook pulling prices never touches key material.
• Read where the credential is asked for. PMXT's quickstart puts a pmxt_api_key and a private_key into the same constructor; the documentation says PMXT's servers never see the private key and does not explain the signing path that would make that true. Self-hosted mode exists for exactly this, and it is in the same package.
• Count the dependencies. They run in the same process as the key. pykalshi has five at runtime — httpx, pydantic, cryptography, python-dotenv and websockets — which is a list a person can actually check.
• Know which credential you are handing over. An exchange API key that can be scoped to trading is a different exposure from a wallet private key that can also move funds. On the on-chain venues, the key that signs an order is the key that holds the collateral.

Nothing in this collection has been run against a funded account by this site. Licences, release dates, commit dates, archive status and dependency lists are read from the repositories and the published packages, and each is dated on the card it came from.