Refactor MCP Paradex server for improved performance, security, and user experience, including updates to dependencies, authentication, and tool handling.

Author: sv

Dockerfile

@@ -17,7 +17,7 @@ ADD . /app
 
 # Create virtual environment and install the project with its dependencies
 RUN --mount=type=cache,target=/root/.cache/uv \
-    uv venv && \
+    uv venv --python 3.12 && \
     . .venv/bin/activate && \
     uv pip install -e .
 
@@ -27,8 +27,7 @@ RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
-COPY --from=uv /root/.local /root/.local
-COPY --from=uv --chown=app:app /app/.venv /app/.venv
+COPY --from=uv /app/.venv /app/.venv
 COPY --from=uv /app /app
 
 # Place executables in the environment at the front of the path
@@ -37,7 +36,5 @@ ENV PATH="/app/.venv/bin:$PATH"
 EXPOSE 8080
 
 # Default: stdio (for local use / Claude Desktop).
-# For Lambda / remote HTTP: override with
-#   CMD ["--transport", "streamable-http", "--port", "8080", "--stateless"]
 ENTRYPOINT ["mcp-paradex"]
 CMD []

src/mcp_paradex/__init__.py

@@ -2,4 +2,4 @@
 MCP Paradex server implementation.
 """
 
-__version__ = "0.1.1"
+__version__ = "0.1.2"

src/mcp_paradex/prompts/__init__.py

@@ -2,30 +2,42 @@
 Trading prompts module initialization.
 """
 
-# Import all prompts to ensure they're registered
+# Always available prompts
 from mcp_paradex.prompts.trader_prompts import (
-    create_optimal_order,
     funding_rate_opportunity,
-    hedging_strategy,
-    liquidation_protection,
+    getting_started,
     market_analysis,
     market_overview,
-    portfolio_risk_assessment,
-    position_management,
     trading_consultation,
     vault_analysis,
 )
+from mcp_paradex.utils.config import config
+
+# Only register auth-required prompts when authenticated
+if config.is_configured():
+    from mcp_paradex.prompts.trader_prompts import (
+        create_optimal_order,
+        hedging_strategy,
+        liquidation_protection,
+        portfolio_risk_assessment,
+        position_management,
+    )
 
 # Export all prompts for convenient importing
 __all__ = [
-    "create_optimal_order",
     "funding_rate_opportunity",
-    "hedging_strategy",
-    "liquidation_protection",
+    "getting_started",
     "market_analysis",
     "market_overview",
-    "portfolio_risk_assessment",
-    "position_management",
     "trading_consultation",
     "vault_analysis",
 ]
+
+if config.is_configured():
+    __all__ += [
+        "create_optimal_order",
+        "hedging_strategy",
+        "liquidation_protection",
+        "portfolio_risk_assessment",
+        "position_management",
+    ]

src/mcp_paradex/prompts/trader_prompts.py

@@ -10,6 +10,9 @@
 
 from mcp.server.fastmcp.server import FastMCP
 from mcp.server.transport_security import TransportSecuritySettings
+from starlette.requests import Request
+from starlette.responses import Response
+from starlette.types import ASGIApp, Receive, Scope, Send
 
 from mcp_paradex import __version__
 from mcp_paradex.utils.config import config
@@ -23,6 +26,31 @@
 logger = logging.getLogger("mcp-paradex")
 
 
+class RejectGetMiddleware:
+    """
+    Rejects GET requests with 405 in stateless HTTP mode.
+
+    In stateless mode (Lambda), GET /mcp would open a persistent SSE stream that
+    Lambda cannot hold open. Returning 405 causes MCP clients to fall back to
+    POST-only mode, which works correctly with Lambda's request/response model.
+    """
+
+    def __init__(self, app: ASGIApp, mcp_path: str = "/mcp") -> None:
+        self.app = app
+        self.mcp_path = mcp_path
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] == "http" and scope["method"] == "GET" and scope["path"] == self.mcp_path:
+            response = Response(
+                content="Method Not Allowed: GET is not supported in stateless mode",
+                status_code=405,
+                headers={"Allow": "POST"},
+            )
+            await response(scope, receive, send)
+            return
+        await self.app(scope, receive, send)
+
+
 def create_server() -> FastMCP:
     """
     Create and configure the FastMCP server instance.
@@ -85,6 +113,8 @@ def run_cli() -> None:
 
     try:
         if args.transport == "streamable-http":
+            import uvicorn
+
             server.settings.port = args.port
             server.settings.stateless_http = args.stateless
             server.settings.host = "0.0.0.0"  # bind all interfaces for container deployments
@@ -94,7 +124,29 @@ def run_cli() -> None:
             server.settings.transport_security = TransportSecuritySettings(
                 enable_dns_rebinding_protection=False
             )
-        server.run(transport=args.transport)
+            starlette_app = server.streamable_http_app()
+            if args.stateless:
+                # Wrap with middleware that rejects GET requests.
+                # In stateless mode GET /mcp would open a persistent SSE stream
+                # that Lambda cannot hold — 405 makes clients fall back to POST-only.
+                starlette_app = RejectGetMiddleware(
+                    starlette_app, mcp_path=server.settings.streamable_http_path
+                )
+
+            import anyio
+
+            async def _serve() -> None:
+                config = uvicorn.Config(
+                    starlette_app,
+                    host=server.settings.host,
+                    port=server.settings.port,
+                    log_level=server.settings.log_level.lower(),
+                )
+                await uvicorn.Server(config).serve()
+
+            anyio.run(_serve)
+        else:
+            server.run(transport=args.transport)
     except KeyboardInterrupt:
         logger.info("Server stopped by user")
     except Exception as e:

src/mcp_paradex/server/server.py

@@ -2,5 +2,11 @@
 Tools module for MCP Paradex.
 """
 
+from mcp_paradex.utils.config import config
+
 # Import tools modules to register them with the server
-from . import account, market, orders, system, vaults
+from . import market, system, vaults
+
+# Only register auth-required tools when authenticated
+if config.is_configured():
+    from . import account, orders

src/mcp_paradex/tools/__init__.py

@@ -9,7 +9,6 @@
 
 # Import the module explicitly so patch() can resolve the dotted path.
 import mcp_paradex.server.server as server_module
-
 from mcp_paradex.utils.config import config
 
 

tests/test_cli.py

@@ -24,7 +24,6 @@
 import mcp_paradex.utils.paradex_client as _client_module
 from mcp_paradex.server.server import server
 
-
 # ---------------------------------------------------------------------------
 # Helpers
 # ---------------------------------------------------------------------------
@@ -258,7 +257,9 @@ async def test_markets_pagination(mock_client):
     records = [{**MARKET_RECORD, "symbol": f"MKT{i}-USD-PERP"} for i in range(5)]
     mock_client.fetch_markets.return_value = {"results": records}
 
-    result = await server.call_tool("paradex_markets", {"market_ids": ["ALL"], "limit": 2, "offset": 0})
+    result = await server.call_tool(
+        "paradex_markets", {"market_ids": ["ALL"], "limit": 2, "offset": 0}
+    )
     data = _json(result)
 
     assert data["total"] == 5
@@ -302,9 +303,7 @@ async def test_orderbook_passes_depth_param(mock_client):
         "bids": [["94999.0", "0.2"]],
     }
 
-    result = await server.call_tool(
-        "paradex_orderbook", {"market_id": "BTC-USD-PERP", "depth": 20}
-    )
+    result = await server.call_tool("paradex_orderbook", {"market_id": "BTC-USD-PERP", "depth": 20})
     data = _json(result)
 
     assert data["market"] == "BTC-USD-PERP"
@@ -490,9 +489,7 @@ async def test_cancel_order_by_client_id(auth_client):
 async def test_order_status_by_order_id(auth_client):
     auth_client.fetch_order.return_value = ORDER_RECORD
 
-    result = await server.call_tool(
-        "paradex_order_status", {"order_id": "ord-1", "client_id": ""}
-    )
+    result = await server.call_tool("paradex_order_status", {"order_id": "ord-1", "client_id": ""})
     data = _json(result)
 
     assert data["results"]["id"] == "ord-1"