How to Connect an AI Assistant to CopyTrader with MCP

What you need

A CopyTrader account

Use your existing account or complete registration using the normal forms. CopyTrader determines your projects and permissions.

A compatible AI client

The client needs remote MCP over HTTPS using Streamable HTTP and OAuth Authorization Code with PKCE S256. It must handle the callback after browser sign-in and securely store connection credentials.

Your application's OAuth client ID and exact redirect URI must be registered with the CopyTrader operator. The server URL alone may not be sufficient. If the profile is not configured, arrange it with the operator first.

Connect step by step

Prepare your account
Sign in to your existing CopyTrader account. New users need to finish registration and its normal verification steps. Registration and MCP connection are separate steps.
Configure the connection in your AI client
Open your client's integration settings. Use the OAuth profile registered for it and the MCP server URL below. Field names depend on the application.
Start authorization
Start the connection using the client and open the CopyTrader link it generates. Enter your details and complete normal verification only on the designated sign-in page.
Approve access
Review the access description and approve the connection through the existing consent flow, including Telegram. After approval, the page continues authorization. Wait for the client to finish connecting.
Check the connection
Ask the assistant to check access and show your projects. A successful web cabinet sign-in or an open callback page alone does not confirm a working MCP connection.
Start by reading data
Select a project and request its status or statistics. Give a separate instruction with specific parameters for settings changes. The product's prescribed confirmations still apply.

MCP server URLhttps://api.copytrader.pw/mcp

Sign in to CopyTrader Create an account

How to check that MCP works

Start with a request that only reads data:

Check my MCP access and show my CopyTrader projects. Use read-only actions for now.

The client should receive a successful response from the protected access-check tool and list the accessible projects. You can then select a project and inspect available capabilities. An empty list calls for checking the account and its projects, not automatically creating a new account.

For a technical check, the client uses get_my_access, get_mcp_capabilities, and list_projects. The client's OAuth component handles credentials and stores them in its secure credential store.

What access you grant

Access covers your Main account and all current and future projects you own, subject to current permissions. The current connection does not offer a separate single-project grant or read-only permission scope. Asking the assistant to read data only limits the instruction, not the granted permissions.

Enter passwords, codes, exchange keys, and tokens only in their designated forms. Do not send them in chat. An MCP token does not replace web cabinet sign-in.

Copy trading involves the risk of loss. Connecting AI does not guarantee returns or identical results across accounts.

How to revoke access

Sign in to the CopyTrader cabinet and open agent connections.
Select the connection and confirm revocation.
To reconnect, complete authorization and consent again through the AI client.

Open agent connections Privacy policy Terms of use

If the connection does not work

Situation	What to check
The client does not offer sign-in or cannot finish it	Check remote MCP and OAuth flow support, the registered client ID, and the exact redirect URI. Contact the operator if the profile does not match.
`local_profile_required`	Finish normal sign-in to the Main cabinet with the same account. Do not create a duplicate account or move Telegram between accounts to work around the error.
Access is revoked or invalid	Reconnect the client through the normal authorization and consent flow.
A project or action is unavailable	Check the selected account, project ownership, current permissions, and the connected server's capabilities.
A change has an unknown outcome	Check the original operation's status first. Do not repeat the change automatically.

Client setup parameters

These are protocol parameters, not a universal configuration file. The client uses authorization server discovery to obtain the current authorization and token endpoints.

Parameter	Value
MCP server / OAuth resource	`https://api.copytrader.pw/mcp`
Transport	Streamable HTTP / HTTPS
OAuth flow	Authorization Code + PKCE S256
OAuth scopes	`mcp.access offline_access`
Authorization server	`https://auth.copytrader.pw/`
Protected resource metadata	`https://api.copytrader.pw/.well-known/oauth-protected-resource/mcp`
Connection information	`https://api.copytrader.pw/.well-known/copytrader-mcp-onboarding`
Client ID / Redirect URI	The profile registered by the operator for your client; the redirect URI must match exactly.

Normal web sign-in, MCP consent, and completion of the code exchange are separate steps. Passwords, OAuth codes, and tokens are handled by the normal forms and the client's OAuth component, not passed to the model in chat.

Local client profile example

The current November 10, 2026 guide specifies the public OAuth client below. Use it if your application supports this profile and can receive its callback. A different redirect URI requires a corresponding operator-registered profile.

Client ID: copytrader-mcp-local
Redirect URI: http://127.0.0.1:6276/oauth/callback
Client secret: Not required for this public client profile.

The client's OAuth component receives the loopback callback on its own machine. It is not the CopyTrader API URL. A different callback requires an operator-registered profile; do not change production service URLs to work around a mismatch.

Sign-in and data reads through Codex were verified with this profile on November 10, 2026. The tested connection settings are shown below. Verify compatibility separately for another client or version; revocation and token refresh require separate checks.

Codex setup

Add the connection in Codex MCP settings. If editing config.toml, use this block; update an existing copytrader connection rather than duplicating it. Do not add a client secret or tokens to the configuration.

[mcp_servers.copytrader]
url = "https://api.copytrader.pw/mcp"
scopes = ["mcp.access", "offline_access"]

[mcp_servers.copytrader.oauth]
client_id = "copytrader-mcp-local"
callback_url = "http://127.0.0.1:6276/oauth/callback"
callback_port = 6276

Sign in through the CopyTrader connection in Codex or use the command below. With --no-browser, open the provided link yourself, approve the connection through Telegram, and paste the full callback URL only into the waiting Codex CLI window. Do not send a URL containing an OAuth code in chat. After sign-in, verify get_my_access and the four initial reads in the next section.

codex mcp login copytrader --no-browser

ChatGPT and Claude require OAuth settings supported by their respective applications. The local Codex callback does not establish cloud-client compatibility or a directory listing.

The OAuth client validates state and issuer, uses PKCE S256 and one resource matching the MCP server URL. The client handles codes, verifiers, and tokens and stores them outside the conversation. On refresh, it saves the replacement refresh token when one is returned.

After Telegram connection approval, the browser continues OAuth automatically. Success is confirmed only after the code exchange and a successful get_my_access call. Per-command Telegram approval is not required where the cabinet does not require it.

Tool and command catalog

After MCP initialize, the client reads tools/list and each tool's inputSchema. This table describes entry points from the current guide; the connected server determines actual availability, parameters, and enabled writes. Do not substitute internal APIs for an unavailable command.

Tool	Purpose
`get_my_access`	Check the current MCP access and its boundaries.
`get_mcp_capabilities`	Read server capabilities; disabled writes must not be bypassed through other calls.
`get_main_cabinet_commands` `get_copy_cabinet_commands`	Read current Main and copy-cabinet command catalogs, parameter schemas, and operation rules.
`list_projects`	Find owned projects by name, following cursor pagination. Ask the user to resolve ambiguous matches.
`main_cabinet_command`	Run Main commands using commandId and parameters: profile, projects, status, domains, reports, and help. M13 searches projects; M45 reads help.
`copy_cabinet_command`	Run a selected project's commands using projectId, commandId, and parameters. C003/C004 find local accounts; C034 controls deposit allocation, C044/C045 handle available limits and drawdown; C062–C074 provide reports and logs.
`start_main_registration` `get_main_registration_status`	Prepare registration and read its status when advertised. The person enters the password in a form. completed with profileReady=true confirms the profile; MCP is connected separately afterward.
`get_private_input_operations` `create_private_input_request` `get_private_input_status` `cancel_private_input_request`	Discover private forms, create an input link, read the result, and cancel a submission not yet accepted. Secret values are not passed through MCP.
`create_project_bot_input_request` `get_project_bot_input_status` `cancel_project_bot_input_request`	Use a private bot-token form and read the new project's draft status. Saving a draft does not itself create a project, invoice, or payment.
`create_main_password_input_request` `get_main_password_input_status` `cancel_main_password_input_request`	Use a form for your own Main password and read its result when advertised. Success can revoke existing sessions, including MCP; a subsequent 401 does not mean the password change failed.
`get_operation_status` `cancel_operation` `request_operation_approval`	Read and, when allowed, cancel an operation using the returned operationId. Submitting a prepared operation requires the user's instruction; it is not automatic and does not imply additional Telegram approval.

Start with four reads using empty arguments: get_my_access, get_mcp_capabilities, get_main_cabinet_commands, get_copy_cabinet_commands. Then find the project and account. Do not perform a write merely to test connectivity.

C027–C029 manage subscriptions within a project. Switching traders or unsubscribing can affect open positions: the user first chooses actions separately for Spot and Futures and, when required, accepts system auto-close. Queue acceptance does not prove exchange execution.

MainSettings and other owners' projects are outside client access. The system admin account is read-only: changes, passwords, keys, and batches involving it are rejected with protected_account. C046, C081, C084, and C107 are also read-only; direct-mode changes, cross-project subscriptions, and history clearing through MCP are excluded. The catalog does not override these boundaries.

Private input and result verification

When the server advertises a private form, the assistant obtains an inputUrl and gives it to you in chat. You open the form and enter the password, code, exchange keys, or token yourself. Do not share the link or send field values to the assistant. Existing cabinet pages remain the fallback when a form is unavailable.

For private input, only completed / saved confirms persistence. executing and outcome_unknown require checking the original outcome rather than retrying automatically. Exchange key validation and trade execution are separate actions.

The client checks isError, structuredContent.error, and the nested data result. Read the actual state after a change. A successful JSON-RPC response does not prove trade execution. For a password, completed reflects the form and service result: the agent neither receives the new password nor tests sign-in with it.

Main cabinet help · Copy cabinet help

Public Main help is available through the help/tree, help/search, and help/articles APIs with product=main-cabinet and language=ru or en. Copy-cabinet articles may require sign-in: a visible tree does not make every article public.