Vibe Trading

English | 中文 | 日本語 | 한국어 | العربية

Vibe-Trading: Your Personal Trading Agent

One Command to Empower Your Agent with Comprehensive Trading Capabilities

Website  ·  Docs  ·  News  ·  Features  ·  Shadow Account  ·  Demo  ·  Quick Start  ·  Examples  ·  API / MCP  ·  Roadmap  ·  Contributing

---

📰 News

• 2026-06-29 🛡️ Live advisory safety + Trading 212 read-only connector + Windows/Gemini fixes: live order guards now have an opt-in, broker-agnostic PreTradeAdvisoryInterface that records advisory reviews without bypassing the mandate gate, kill switch, or audit trail (#328, closes #317, thanks @shadowinlife). Trading 212 joins the connector layer with read-only account, positions, orders, history, and instrument-metadata support; place_order / cancel_order still hard-refuse until a structural paper/live boundary exists (#321, closes #309, thanks @mvanhorn). Windows startup avoids the pandas 3.0 Timestamp crash via the `

Earlier news

• 2026-06-26 🎯 Shadow Account conditional entry + tushare ETF/index/HK routing: extracted Shadow Account rules now carry RSI / prior-return bounds, so the generated SignalEngine enters on real conditions (RSI in range, prior-return in range) instead of blindly replaying the holding cadence (#314, follows #302, thanks @Robin1987China). The tushare loader also routes ETF/LOF → fund_daily(), indices → index_daily(), and HK equities → hk_daily() instead of always calling daily() (which silently returns empty for non-stocks), with per-symbol empty-result + partial-fetch warnings (#315, closes #310, thanks @shadowinlife).
• 2026-06-25 🧪 Strict validation JSON + calmer agent context: standalone backtest validation now normalizes nested NaN / Infinity values before writing artifacts/validation.json or CLI stdout, so strict JSON parsers no longer choke on validation payloads (#306, thanks @gyx09212214-prog). The agent prompt also derives the current data-source count from the loader registry, and _microcompact() now waits for real token pressure instead of clearing older tool results during short runs (#296, closes #282, thanks @MarkfuGod).
• 2026-06-24 🎯 Shadow Account price context + reactive Chinese UI + LAN auth fix: Shadow Account rule extraction now sees PIT-safe entry context — entry_rsi14 and prior_5d_return fetched through the loader registry as of buy_dt, with graceful offline/no-data degradation (#302, follows #295, thanks @Robin1987China). The main Web UI panels now use reactive English / zh-CN translations across charts, chat, Alpha Library, Correlation, and Run Detail (#301, thanks @skloxo). Remote same-origin Web UI deployments with API_AUTH_KEY can post and upload again after the CSRF hardening, while mismatched cross-site origins remain blocked (#304, thanks @Hinotoi-agent).
• 2026-06-23 🛡️ Local API CSRF hardening: a malicious web page can no longer drive unsafe cross-site requests (POST/PUT/DELETE) against the loopback API — CORS blocks reading the response but not the side effect, so loopback dev-mode trust now applies the existing cross-site guard to unsafe methods before honoring it. Safe methods and local CLI / non-browser uploads are unaffected (#293, thanks @Hinotoi-agent).
• 2026-06-22 🔧 Live-authorize OAuth fix + Alpha Zoo headline fix: connector authorize now holds the OAuth handshake open through a multi-minute broker sign-in (tunable via VIBE_LIVE_AUTHORIZE_TIMEOUT_SECONDS) and no longer spawns a competing callback server on retry, so the token actually persists (#281, closes #259, thanks @Robin1987China). The Alpha Zoo page no longer prints its alpha count twice (#287, closes #286, thanks @digger-yu). Scheduled research also picked up end-to-end usage docs (#288).
• 2026-06-21 ⏰ Scheduled-research executor + Reports library + post-backtest attribution: scheduled research now runs end to end — a default-off background executor (VIBE_TRADING_ENABLE_SCHEDULER) fires due interval/cron jobs through the session runtime (#278, thanks @mvanhorn, closing #254). A new /reports Run Library page lists, searches, and filters report-worthy runs with links into Run Detail + Compare (#224, thanks @LemonCANDY42). And after every backtest the agent now runs layered attribution — trade-level winners/losers, beta regression, market-regime analysis, and a Monte Carlo permutation test, gated by data availability and routing (#280, thanks @shadowinlife).
• 2026-06-20 🔬 Research Autopilot loop closes (Phase 3) + loader OHLC integrity guard + 4 academic alphas: Research Autopilot now runs hypothesis → signal-engine → backtest end to end — scaffold_signal_engine writes a contract-correct engine and link_autopilot_backtest feeds run metrics back to the hypothesis (68 tools) (#267). A structural OHLC sanity check drops dirty bars (high hint — so locating the trace for a finished run no longer means guessing which folder under agent/sessions/ is newest by timestamp. The new vibe-trading resume subcommand reopens that exact session and replays its recent turns into the loop; an unknown id fails fast instead of silently starting a blank session (#218, thanks @zwrong).
• 2026-06-12 🩺 Provider reliability overhaul — DeepSeek hangs, Kimi access, streaming liveness: A cluster of provider reports — DeepSeek runs stuck on "Agent is working…" (#208, thanks @XYWOX), reached max iterations masking empty model responses (#203, thanks @mojianliang), the UI never recovering after a stall (#195, thanks @mafia23), and Kimi rejecting the client (#204, thanks @liao497) — shared one root: every OpenAI-compatible provider ran through a single shim that applied DeepSeek/Kimi/Gemini quirks globally and silently swallowed stream failures. Provider-specific behavior now lives in an explicit capability layer — reasoning capture/replay, Gemini thought signatures, the Kimi User-Agent, OpenRouter's reasoning body are each gated to their own provider instead of cross-contaminating. Reasoning-only streams show a live "Reasoning…" indicator instead of dead air; a stream failure raises a contextual provider_stream_error with one automatic retry for transient resets (deterministic 4xx fail fast) instead of silently falling back to a slow non-streaming call; an empty model response is reported as empty_model_response instead of "max iterations"; SSE heartbeats no longer break reconnect replay; and a stuck read-only tool times out instead of hiding behind heartbeats forever. A new vibe-trading provider doctor prints a redacted provider/model/package/proxy snapshot for one-command triage of environment-side hangs. DeepSeek users can opt into the official native adapter with pip install "vibe-trading-ai[deepseek]", and kimi-k2.x's temperature=1 requirement is applied automatically — the Kimi path is verified end-to-end against the live API (tool calls + strict multi-turn reasoning replay on kimi-k2.6).

• 2026-06-11 🐝 Swarm workers now pull market data through the loader layer: An investment-committee run on NVDA exposed a chain of gaps — workers wrote ad-hoc yfinance scripts, trusted a malformed latest bar (volume present, OHLC empty), leaked NaN into non-strict JSON, and a context-free continuation prompt re-routed to the wrong preset (#198, thanks @BillDin for an exceptional diagnosis plus both fixes). Swarm workers now get a local get_market_data tool backed by the same normalized loader registry as MCP — strict JSON, non-finite floats serialize as null — wired into every market-data preset (21 workers across 13 presets) with a prompt policy that steers OHLCV work tool-first (#199); run_swarm takes an explicit preset_name and refuses ambiguous continuation fragments instead of silently falling back to equity_research_team (#200). Grounding got smarter too: a bare US ticker like NVDA in a swarm prompt is promoted to NVDA.US (stopword-guarded), so workers start from authoritative pre-fetched prices. The tool joins the main agent registry as well — 48 tools now. Also: your Docker data now survives updates — persistent memory, the session search index, user-created skills, shadow accounts and broker config live in named volumes, so docker compose up --build no longer wipes them (#197, thanks @FlyerJ).
• 2026-06-10 🐳 Docker reaches a host-side Ollama out of the box: Inside the container localhost is the container itself, so the shipped OLLAMA_BASE_URL=http://localhost:11434 failed the LLM preflight for every Dockerized Ollama setup. docker-compose.yml now defaults to http://host.docker.internal:11434 (export OLLAMA_BASE_URL to point elsewhere) and adds the host-gateway extra_hosts mapping so the same file works on Linux as well as Docker Desktop (#196, thanks @ShahNewazKhan).
• 2026-06-09 🔑 Clearer error when the Web UI is opened from another machine: Reaching the chat from a non-loopback client (another machine, a VM host, a phone on your LAN) without API_AUTH_KEY set returned 403 on every sensitive endpoint — sending a message, listing sessions, live status — but the chat only showed a generic "Failed to send message, please retry." The send path now surfaces the real reason — "Remote API access requires an API key. Add it in Settings, or run the backend on localhost for local-only use." — and the README's web-UI setup spells out the localhost-vs-LAN rule plus the three fixes (browse via localhost on the same machine; set API_AUTH_KEY and enter it once in Settings; or VIBE_TRADING_TRUST_DOCKER_LOOPBACK=1 for Docker Desktop's host gateway) (#191, thanks @mafia23).
• 2026-06-08 🔧 Gemini 3.x multi-turn tool-calling fix: This completes the Gemini 3.x thinking-model fix. The 6/05 round-trip (#176) only covered in-memory history, but the real agent loop replays history as OpenAI-format dicts where LangChain dropped the per-tool-call thought_signature before the request was built — so multi-turn tool calling still 400'd with missing thought_signature. It is now re-attached at the single _convert_input chokepoint both invoke and stream pass through (parallel calls, where only the first of N is signed, included) (#184, thanks @ngoanpv).
• 2026-06-07 🐝 Live swarm status in the chat timeline: When the agent launches a multi-agent swarm (investment committee, quant desk, risk committee, …), the chat now renders an inline status card that streams each worker's state — waiting / running / done / failed / blocked / retrying — in real time, the same per-agent visibility the standalone swarm dashboard already had. Runtime events are bridged into the session SSE stream without changing the existing /swarm/runs API, and a finished card rehydrates from the final run_swarm result on reconnect or history replay (#188, thanks @BillDin). Preset routing also got sharper: an explicitly named preset (e.g. investment_committee, with or without underscores) now wins over keyword scoring, and the bare IV derivatives keyword no longer false-matches inside ordinary words like "given" (#189, thanks @BillDin).
• 2026-06-06 ⚖️ Alpha compare — head-to-head across CLI, Web UI, REST & agent: A new alpha compare benches a hand-picked shortlist of Alpha Zoo alphas against each other on a universe and period, then ranks them by IC mean/std, IR, IC-positive ratio or sample count — each with its gap to the leader. Unlike a full-zoo bench it evaluates only the alphas you name (a new run_bench(only=…) subset filter), so comparing three alphas no longer scores all 191 in their zoo. One shared core powers every surface: vibe-trading alpha compare … --sort ir (CLI), a Compare view in the Alpha Zoo Web UI (tick alphas in the catalogue → one-click compare with a streamed ranking table), POST /alpha/compare + SSE (REST), and a read-only alpha_compare agent tool (47 tools now).
• 2026-06-05 🇮🇳 Dhan + Shoonya connectors (India) — 10 brokers total: The connector-first trading layer adds Dhan and Shoonya for the Indian market (NSE/BSE equities + F&O), bringing the roster to ten brokers. Both are paper + read-only — like Longbridge, their APIs expose no runtime paper/live discriminator, so their place_order / cancel_order hard-refuse any non-paper config at the first line (the rule: a broker with no structural paper/live guard is capped at paper + read-only) (#181, closes #174). This cycle also fixes Gemini 2.5 / 3.x thinking models: their per-tool-call thoughtSignature now round-trips through the OpenAI-compatible path, so multi-turn function calling no longer fails with INVALID_ARGUMENT (#176, closes #170, thanks @mvanhorn & @jliu6789). Chinese docstrings landed on all 452 Alpha Zoo factors (#180, thanks @LeeCQiang), and a frontend test suite (197 vitest tests) plus backend auth / path-traversal / CORS security tests joined CI (#175, thanks @sambazhu).
• 2026-06-04 🗃️ Opt-in local data cache for all 7 data sources: A new VIBE_TRADING_DATA_CACHE switch lets every backtest loader — tushare, okx, ccxt, akshare, mootdx, yfinance, futu — cache settled historical bars under ~/.vibe-trading/cache (user home, never the repo), so repeated and long-horizon / cross-market backtests skip the network

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: HKUDS
• Source: HKUDS/Vibe-Trading
• License: MIT
• Homepage: https://vibetrading.wiki/

Install and usage instructions live in the source repository linked above.