Repository navigation
fix(mcp): link the live API key page and fix client setup in the README - #4061
Conversation
The missing-token error and the access_token description linked /price-feeds/pro/acquire-access-token, which returns 404; link acquire-api-key instead. The README's Claude Desktop snippet put a "url" entry in claude_desktop_config.json, which Claude Desktop ignores. Each client snippet now sends the key as an Authorization header; Claude Desktop does so through a pinned mcp-remote. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Greenlight — 🚫 Blocked — see reasons below ( Blocking reasons:
|
|
Greenlight — 🚫 Blocked — see reasons below ( Blocking reasons:
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a8e3e4bf5a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ### VS Code | ||
|
|
||
| Any MCP client that supports StreamableHTTP can connect using the URL: | ||
| Add to `.vscode/mcp.json`. VS Code prompts for the key once and stores it securely: |
There was a problem hiding this comment.
For users running current VS Code Agent Host sessions, this quick-start configuration does not expose the server: the official MCP configuration reference states that VS Code does not forward .vscode/mcp.json servers requiring interactive ${input:...} variables. Since this snippet combines both, setup can appear successful while no Pyth tools are available; use an Agent Host-compatible portable configuration and secret mechanism, or explicitly limit these instructions to extension-host sessions.
Useful? React with 👍 / 👎.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
PLAN.md still said keys are per-call only, quoted the old error texts and token link, and listed CLI flags, PYTH_LOG_FILE and an npx package that never existed. It now matches the code: the key comes from the client configuration or per call, the configuration table lists the real env vars, and the smoke test uses the hosted server or a local build. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The tool tables predated the 2026-10 API update, and convert_date_to_timestamp had no section. Each tool now lists its current parameters, limits and response shape, taken from src/tools/. The package is the private @pythnetwork/mcp, not @pyth-network/mcp-server on npm, and the server is hosted at mcp.pyth.network. The project tree now shows the real files, and the resources and prompts sections say what is built (two feed resources) and what is still planned. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
| - `symbols` accept full symbols (`Crypto.BTC/USD`) or bare pairs (`BTC/USD`). A bare pair resolves to the live spot feed, otherwise to the only remaining live match; an ambiguous input returns an error listing the candidates. `resolved_symbols` in the response shows each mapping. | ||
| - If both `price_feed_ids` and `symbols` are given, only the IDs are used. | ||
| - `channel`: `real_time`, `fixed_rate@50ms`, `fixed_rate@200ms` or `fixed_rate@1000ms`; default `fixed_rate@200ms` (`PYTH_CHANNEL`). A channel faster than the feed's `min_channel` returns no price. | ||
| - Requested feeds that return no price (e.g. `beta` or `coming_soon` feeds) are listed in `missing_feed_ids`. |
There was a problem hiding this comment.
🔍 Missing-feed metadata is not shared by every price tool
The shared summary promises missing_feed_ids, but get_price_range omits it and get_candlestick_data reports no data differently.
Was this helpful? React with 👍 or 👎 to provide feedback.
| **Returns:** Array of `{ pyth_lazer_id, name, symbol, description, asset_type, exponent, min_channel, state, hermes_id, quote_currency }` | ||
|
|
||
| **LLM description:** *"List available Pyth Pro price feeds. Use this to discover what feeds exist before fetching prices. You can filter by asset type (crypto, equity, fx, metal, rates, commodity) or search by name/symbol."* | ||
| **Returns:** `{ feeds, count, total_available, offset, has_more, next_offset, note? }`. Each feed is compact by default: `pyth_lazer_id`, `symbol`, `name`, `description`, `asset_type`, `instrument_type`, `state`, `exponent`, `min_channel`, `quote_currency`, plus `groups`, `expiration_time` and `symbol_chain_id` where set. With a token, each feed has `entitled`, and `not_entitled_reason` when it is `false` (not live yet, or the plan lacks an entitlement group). |
There was a problem hiding this comment.
🔍 Entitlement flags can be absent with a token
If the entitlement request fails, get_symbols returns feeds without entitled and includes an explanatory note. The summary currently promises the flag for every token-backed feed.
Was this helpful? React with 👍 or 👎 to provide feedback.
PLAN.md listed missing_feed_ids, ID precedence and display_* as shared by every price tool. Only get_latest_price and get_historical_price return missing_feed_ids, get_candlestick_data takes one symbol and returns display-unit candles, and get_price_range also returns its channel. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Checked against each client's current docs:
- VS Code: Agent Host sessions skip .vscode/mcp.json servers that use
${input:...}, so use the user-level ~/.copilot/mcp-config.json, and
say that it holds the key in plain text.
- Claude Desktop: custom connectors live under Customize > Connectors
and can send a header with Anthropic's request-headers beta.
- Cursor: headers accept ${env:...}, which keeps the key out of the file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
| "pyth": { | ||
| "type": "http", | ||
| "url": "https://mcp.pyth.network/mcp", | ||
| "headers": { "Authorization": "Bearer YOUR_TOKEN" }, |
There was a problem hiding this comment.
🟨 API key persisted in plain text
The VS Code setup writes YOUR_TOKEN into a persistent user file instead of using the previous password prompt. Backups or local tools with file access can expose the user's Pyth Pro key.
Was this helpful? React with 👍 or 👎 to provide feedback.
Without it, claude mcp add writes to local scope, so the Pyth tools load only in the folder where the command ran. User scope loads them in every project and keeps the key private to the user (both live in ~/.claude.json). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owners add organization custom connectors under Organization settings > Connectors; members then connect from Customize > Connectors. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
User scope lets any project, including one with untrusted instructions, call the price tools with the configured key. Keep the default local scope and mention --scope user as an opt-in. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
apps/mcp is a read-only service: it fetches prices with each caller's own Pyth Pro key, never holds one itself, and is off the price path. Like the other consumer apps, its changes can be self-authorized. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
| - "apps/entropy-explorer/**" | ||
| # MCP server: reads prices with each caller's own key and serves them to AI | ||
| # clients; read-only, off the price path, and holds no key of its own | ||
| - "apps/mcp/**" |
There was a problem hiding this comment.
🔍 Auto-approval covers MCP runtime changes
The apps/mcp/** entry also covers future changes to server code and configuration. Confirm that both belong in the self-authorized merge category.
Was this helpful? React with 👍 or 👎 to provide feedback.
This branch was successfully deployed
2 participants
Summary
access_tokendescription linked/price-feeds/pro/acquire-access-token, which returns 404. They now linkacquire-api-key.Authorization: Bearerheader:"url"entry inclaude_desktop_config.json, but Claude's docs use that file for local servers and connect remote ones as custom connectors. Now:mcp-remote@0.14.3(pinned, third-party note), or a custom connector with Anthropic's request-headers beta~/.cursor/mcp.json, with${env:...}as an option to keep the key out of the file~/.copilot/mcp-config.json, since Agent Host sessions skip.vscode/mcp.jsonservers that use${input:...}; the README notes the file holds the key in plain textconvert_date_to_timestamp.@pythnetwork/mcp(not an npm package), hosted atmcp.pyth.network; real env vars, run commands and project tree; resources and prompts marked built or planned.apps/mcp/**joins theauto_approve_pathsallowlist, so future MCP PRs can be self-authorized. The MCP server only reads prices with each caller's own key, holds none itself, and is off the price path. Greenlight reads its config frommain, and.github/greenlight.ymlalways needs a human, so this PR still needs a review.Related docs update and redirect for the old path: pyth-network/pyth-lazer#4014. Once the docs deploy, the redirect also fixes the link for 0.3.0.
Testing
pnpm --filter @pythnetwork/mcp buildandtest:unit(304/304)mcp-remote@0.14.3with this config againstmcp.pyth.network. Price tools work withoutaccess_token; without the header, the server returns the missing-token error.🤖 Generated with Claude Code