MCP servers › markets.borro › borro

MCP server · registry snapshot 2026-10-28 · last tested 2026-10-28

markets.borro/borro

by borro.markets · domain (the registry's namespace rule)Website ↗

Stock lending on Robinhood Chain: read markets and prepare lends, loans, shorts and credit lines. — the publisher's description

1 of 2 record checks metRead-only · tools listed 2026-10-28version 1.0.0streamable HTTP61 tools

Summary

markets.borro/borro is a remote MCP server listed in the official MCP registry at version 1.0.0, under the namespace of the domain borro.markets. On 2026-10-28 ProtocolProbe connected to it in read-only mode and read its inventory: 61 tools, 0 resources and 0 prompts.

Record checks

1 of 2 record checks met · 7 do not apply

met: Registry entry is active and says how to run it
not met: Source repository link opens
not applicable: Repository is not archived
not applicable: Code pushed to the repository in the 90 days before our check
not applicable: Repository publishes a security policy (SECURITY.md)
not applicable: Package names its licence with a standard (SPDX) identifier
not applicable: The version the registry lists can be installed and is not withdrawn
not applicable: npm package carries build provenance (attestation)
not applicable: No known critical or high advisory in the package or its dependencies

Not ranked by downloads: a remote server publishes no download figure
Not ranked by stars: no public GitHub repository

From public records, not a safety rating. Each check with its reason

Key facts

Runs: remote (hosted by the publisher)
Transport: streamable HTTP
Your own values: none declared (not a guarantee)
Sign-in: none needed to open a session
Tools: 61
Last tested: 2026-10-28

Tool list size

28,210 tokens on Claude Opus 5.5

Added to every request that loads this server's tools (61 tools). Counted with Anthropic's token counter on 2026-10-28, from the tool list we read on 2026-10-28. Median across 23,424 counted servers: 2,725 tokens. How it is counted

How a client gets in

Connects without signing in

Read from the server's public metadata on 2026-10-28 (borro.markets), in our read-only connection; no tool was called. It may have changed since. How it is read

Tool list at the three APIs

Not sent yet for this version (1.0.0).

Add to your client

How fresh this is

Live-tested: yes, a real session (not a text-only review)
Last tested: 2026-10-28
Mode: read-only (no tool calls)
Latest version: 1.0.0, published 2026-10-27 (registry, as of the 2026-10-28 snapshot)
First listed version: 2026-10-27 (earliest version still in the registry; older removed versions would be earlier)
Registry data: snapshot 2026-10-28
Package and repository: checked 2026-10-28
Engine: mcp-runtime-engine@0.1.0 · sdk@1.32.0

Dead or stale signals

None found in the records we hold

Looked for and not found: deprecated in the registry. Does not apply: listed version cannot be installed or is withdrawn; repository link does not open; repository archived; no push in over 365 days. Each line is a dated fact from a public record. It does not say whether the server still works, and a record can change after the date shown.

Changes since the last refresh

New in the registry: not in the list of 2026-10-27, listed on 2026-10-28 with version 1.0.0 (published 2026-10-27).

Source: the official MCP Registry list on 2026-10-27 and on 2026-10-28.

What it is

What does this server offer?

Observed inventory

61tools

0resources

0prompts

None of its 61 tools are described as changing anything. For 61 the reading was uncertain, so no mark is shown.

marketson 5 other servers
“Every stock on Borro and the USDG vault: price, what is lent, borrowed and free to short, what lenders earn and what shorters pay a year (one number each, $BORRO included once it has been paid), the …”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
Takes no inputs.
marketon 2 other servers
“One stock's full line from the shelf: rates, sizes, limits, open fee and its contracts.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
1 input, 1 required
- symbolstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
healthon 87 other servers
“For bots that watch for liquidation: every short and USDG loan of a wallet, worst first, with how much of its limit it uses (limit_used, 1 = Morpho can liquidate it now), health (1 / limit_used), the…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
1 input, 1 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
positionon 3 other servers
“Everything a wallet has on Borro: stock lent, shorts (owed, money held, the price it is closed for you at, and parts: how much of the stock's one short is the wallet's own, a pair's and a basket leg'…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
1 input, 1 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
tradeson 4 other servers
“Borro-wide recent shorts opened and closed, newest first.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
Takes no inputs.
priceson 3 other servers
“For each stock token on Borro: the stock's own price (its Chainlink feed while the market is open; Borro's weekend estimate and 95% band while it is shut), the token's executable buy and sell price o…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
Takes no inputs.
bear_coins
“The bear coins directory: every coin launched on Pons from Borro with its own short, its stock, P/L, burns and fees.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
Takes no inputs.
ruleson 6 other servers
“Borro's house rules, limits, what can go wrong, and every contract address with what it does, to verify on chain.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
Takes no inputs.
open_short
“Unsigned transactions to short a stock from the wallet: approve the deposit if needed, then BorroShort.open (borrow the stock, sell it, hold the money plus the deposit).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
4 inputs, 3 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- symbolstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
- amountstringrequired“Stock to short, in whole units as a decimal string, like "1.5"”
- depositstring“USDG to add to the money held, beyond the sale (optional, default 0), in whole units as a decimal string, like "1.5"”
close_short
“Unsigned transactions to close the wallet's short on a stock: buy back everything owed, return it, take out the money held (with a USDG top-up approval if it is under water).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
2 inputs, 2 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- symbolstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
supply
“Unsigned transactions to lend a stock to shorters (it earns lending fees) or USDG in the Borro USDG vault (it earns interest).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
4 inputs, 3 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- assetstringrequired“USDG, or a stock symbol”
- amountstringrequired“Amount to lend, in whole units as a decimal string, like "1.5"”
- postboolean“Stock only: lend and post as collateral in one step”
withdrawon 14 other servers
“Unsigned transaction to take back lent stock or USDG (part, or all with all: true).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
4 inputs, 2 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- assetstringrequired“USDG, or a stock symbol”
- amountstring“Amount to take back, in whole units as a decimal string, like "1.5"”
- allboolean“Take back everything”

Show 49 more tools

borrowon 1 other server
“Unsigned transaction to borrow USDG against stock already lent and posted (supply with post: true first).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
3 inputs, 3 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- symbolstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
- amountstringrequired“USDG to borrow, in whole units as a decimal string, like "1.5"”
repay
“Unsigned transactions to repay USDG borrowed against a stock (part, or all with all: true).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
4 inputs, 2 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- symbolstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
- amountstring“USDG to repay, in whole units as a decimal string, like "1.5"”
- allboolean“Repay everything owed”
bind_builder
“Credits a bookrunner's code with the wallet's borrowing on Borro (Bookrunners): the bookrunner earns Borro's own fee on the interest the wallet pays, all of it for 12 months, half after; the wallet p…”
Publisher declares: read-only no · destructive no · idempotent yes · open-world no
4 inputs, 2 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- codestringrequired“The bookrunner's code, as in borro.markets/?ref=<code>”
- timestampinteger“With signature: the timestamp from the typed data that was signed”
- signaturestring“The wallet's EIP-712 signature, 0x and 130 hex characters; leave out to get the typed data”
open_pair
“Unsigned transactions for a pair trade: buy and lend the long stock in your name (it earns lending fees while held), then short the other, approvals first.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
6 inputs, 5 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- longstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
- shortstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
- long_amountstringrequired“Long stock to buy, in whole units as a decimal string, like "1.5"”
- short_amountstringrequired“Stock to short, in whole units as a decimal string, like "1.5"”
- depositstring“USDG held against the short beyond the sale (optional), in whole units as a decimal string, like "1.5"”
close_pair
“Unsigned transactions to close the wallet's newest open pair of these two stocks: the pair's own part of the short closed (a basket leg or a short of its own on the same stock stays open, listed in s…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
3 inputs, 3 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- longstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
- shortstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
buy_with_eth
“Unsigned transaction swapping the wallet's ETH for USDG or a stock on Uniswap, or through Route (route.fun) for a stock bought exact in when Route guarantees more (no Borro contract, no Borro fee), f…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
4 inputs, 3 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- wantstringrequired“USDG, or a stock symbol”
- amountstringrequired“How much of it to get, in whole units as a decimal string, like "1.5"”
- slip_bpsinteger“Most the price may move, in hundredths of a percent (default 100, 1%)”
open_long
“Unsigned transactions for a leveraged long on a stock in one open: USDG margin plus a flash-borrowed debt buy the stock, which is lent (it earns lending fees) and posted, and the debt is borrowed aga…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
4 inputs, 4 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- symbolstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
- marginstringrequired“USDG margin from the wallet, in whole units as a decimal string, like "1.5"”
- leveragenumberrequired“Leverage, more than 1, like 1.5”
close_long
“Unsigned transaction closing all or part of the wallet's leveraged long on a stock: the stock is sold, the debt repaid, and the rest comes back in USDG.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
3 inputs, 2 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- symbolstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
- percentnumber“How much of the position to close, 1 to 100 (default 100)”
farms
“Borro's stock farms: a Uniswap v4 USDG/stock pool per stock, run by Borro's own hook, that lends what swaps do not need on Borro.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
2 inputs
- symbolstring“One stock's farm (optional), by its ticker, like NVDA; farms lists the stocks that have one”
- walletstring“A wallet whose part of each farm to show (optional)”
farm_deposit
“Unsigned transactions to put USDG and a stock into its farm from the wallet: give usdg or stock (or both) and the other follows the farm's ratio (the feed's price for the first deposit, which sets th…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
5 inputs, 2 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- symbolstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
- usdgstring“USDG to put in (optional if stock is given), in whole units as a decimal string, like "1.5"”
- stockstring“Stock to put in (optional if usdg is given), in whole units as a decimal string, like "1.5"”
- slip_bpsinteger“Most the farm may move against the quote, in hundredths of a percent (default 50, 0.5%)”
farm_withdraw
“Unsigned transaction to take part or all of the wallet's money out of a farm.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
4 inputs, 2 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- symbolstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
- percentnumber“How much of the wallet's part to take out, 1 to 100 (default 100)”
- slip_bpsinteger“Least accepted under the preview, in hundredths of a percent (default 50, 0.5%)”
weekend
“While the stock market is shut (Friday 8pm to Sunday 8pm New York, and holidays) the price feeds stop at their last print.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
1 input
- symbolstring“One stock (optional), by its ticker, like NVDA; with a pool, its quotes are read from the chain”
buy_cover
“Unsigned transactions to buy Monday-gap cover on a stock while the market is shut (until an hour before the reopen): side up pays if the first feed print after the reopen is more than the strike abov…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
5 inputs, 4 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- symbolstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
- sidestringrequired“up (pays on a gap up: for a short) or down (on a gap down: for a long)”
- notionalstringrequired“Cover, in USDG: for a short, about what the shares are worth, in whole units as a decimal string, like "1.5"”
- strike_bpsinteger“How far the stock must move before it pays, in hundredths of a percent: 100, 200, 300 or 500 are quoted (default 200, 2%)”
deposit_cover
“Unsigned transactions to put USDG into the gap cover pool, which backs every cover and keeps the premiums (less Borro's share) on top of the Steakhouse USDG vault's interest.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
2 inputs, 2 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- amountstringrequired“USDG to deposit, in whole units as a decimal string, like "1.5"”
withdraw_cover
“Unsigned transaction to take USDG out of the gap cover pool, an amount or all: true.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
3 inputs, 1 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- amountstring“USDG to withdraw, in whole units as a decimal string, like "1.5"”
- allboolean“Withdraw everything this wallet has in the pool (only when it is all free)”
settle_cover
“Unsigned transaction settling a cover with the feed's first round at or after its reopen (found by walking back from the latest round), with what it pays the buyer.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
2 inputs, 2 required
- walletstringrequired“The address that will send it (any address; the payout goes to the cover's buyer)”
- idstringrequired“The cover's number (position lists a wallet's covers)”
claim_cover
“Unsigned transaction taking USDG a settled or voided cover could not send to the wallet (it waits in the pool's owed); position shows owed_usdg.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
1 input, 1 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
optionson 1 other server
“One stock's options chain for this Friday and next (expiry Friday 8pm New York): per strike and side the series id, Borro's fair value (Black-Scholes from the stock's own measured volatility, a guide…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
1 input, 1 required
- symbolstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
write_option
“Unsigned transactions to write options from the wallet: post an ask at a premium (the collateral is locked now; it fills when a buyer takes it), or with order_id sell into that bid now and receive it…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
9 inputs, 3 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- symbolstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
- typestring“call or put”
- expirystring“this (the nearest Friday still taking orders, the default), next, or a Friday's date like 2026-10-16”
- strikestring“The strike in dollars, on the $0.25 tick, like "250"”
- sharesstringrequired“Shares to write (at least 0.001), in whole units as a decimal string, like "1.5"”
- premiumstring“Premium you ask, USDG a share (for an ask), in whole units as a decimal string, like "1.5"”
- fromstring“Where the lock comes from: a call stock (default) or shares; a put usdg (default) or shares”
- order_idstring“Sell into this bid instead of posting an ask (its series, its premium)”
buy_option
“Unsigned transactions to buy options from the best ask of a series (or a given ask with order_id), checked on chain: exact approval of the premium, then fillAsk with that premium as the most it may t…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
8 inputs, 3 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- symbolstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
- typestring“call or put”
- expirystring“this (default), next, or a Friday's date like 2026-10-16”
- strikestring“The strike in dollars, like "250"”
- sharesstringrequired“Shares to buy, in whole units as a decimal string, like "1.5"”
- order_idstring“Buy from this ask instead of the best one”
- max_premiumstring“The most to pay in all, USDG (optional), in whole units as a decimal string, like "1.5"”
post_bid
“Unsigned transactions to post a bid for a series at a premium a share: the premium for all the shares is locked now in USDG (exact approval, then postBid) and goes to the writer who fills it, less Bo…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
7 inputs, 6 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- symbolstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
- typestringrequired“call or put”
- expirystring“this (default), next, or a Friday's date like 2026-10-16”
- strikestringrequired“The strike in dollars, like "250"”
- sharesstringrequired“Shares to bid for, in whole units as a decimal string, like "1.5"”
- premiumstringrequired“Premium you bid, USDG a share, in whole units as a decimal string, like "1.5"”
cancel_orderon 46 other servers
“Unsigned transaction cancelling an ask or a bid: what it still locks goes back to its maker (an ask's collateral, a bid's USDG).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
2 inputs, 2 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- order_idstringrequired“The order's number (position lists this wallet's open orders)”
settle_series
“Unsigned transaction settling a series after its Friday 8pm New York expiry with the feed's last round at or before it, found by walking back from the latest round, once the proof holds (the next rou…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
6 inputs, 1 required
- walletstringrequired“The address that will send it (any address)”
- series_idstring“The series id (or symbol, expiry, strike and type instead)”
- symbolstring“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
- expirystring“A Friday's date like 2026-10-16”
- strikestring“The strike in dollars”
- typestring“call or put”
claim_option
“Unsigned transaction burning the wallet's tokens of a settled series and taking what they pay: a call pays the stock's Borro vault shares, a put USDG (or the Steakhouse vault's shares with as_shares,…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
4 inputs, 2 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- series_idstringrequired“The series id (position lists them)”
- sharesstring“Shares to claim (optional, default all), in whole units as a decimal string, like "1.5"”
- as_sharesboolean“A put: take Steakhouse USDG vault shares instead of USDG”
release_collateral
“Unsigned transaction giving a writer back the lock of a settled series less what its written options pay, once: stock vault shares for a call, Steakhouse USDG vault shares for a put.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
2 inputs, 2 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- series_idstringrequired“The series id (position lists them)”
credit_markets
“Agent Credit Lines: an agent posts its AI credits (Orbio CREDIT) and borrows USDG against them inside limits its owner sets once: a ceiling, a daily limit, a target LTV and an allowlist.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
Takes no inputs.
credit_line
“One agent credit line (account) or the lines a wallet owns (owner: five a call, newest first; page 2 for the next five): its market, credits posted, USDG owed, LTV against its target, trigger and LLT…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
3 inputs
- accountstring“A line's address”
- ownerstring“A wallet whose lines to list”
- pageinteger“With owner: which five lines, newest first (default 1)”
holder_benefits
“Hold $BORRO.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
2 inputs, 1 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- borrow_usdgstring“Optional: a planned borrow in USDG, to see the $BORRO its full rate needs, in whole units as a decimal string, like "1.5"”
credit_open
“Unsigned transactions.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
17 inputs, 1 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- accountstring“An existing line: post more and/or borrow from it (leave out to open a new line)”
- marketstring“New line: which market, by its symbol in credit_markets (default CREDIT)”
- agentstring“New line: the agent's address, the wallet that will borrow from it (not the owner's)”
- creditsstring“Credits to post, in whole units as a decimal string, like "1.5"”
- borrowstring“USDG to borrow now (optional), in whole units as a decimal string, like "1.5"”
- tostring“Where borrowed USDG goes: the owner or an allowlisted address (default the wallet, or the owner)”
- ceilingstring“New line: the most USDG the line may owe (optional), in whole units as a decimal string, like "1.5"”
- daily_limitstring“New line: the most USDG out in any 24 hours, like "100", or "none" (default the ceiling; $100 with a gas station, at most $5,000)”
- target_ltvnumber or string“New line: target LTV, a fraction under 1 like 0.18 or a percent with its sign like "18%" (the market's default: 0.18 for CREDIT)”
- trigger_ltvnumber or string“New line: LTV above which the keeper may protect it (default by the market's rule)”
- allowarray“New line: addresses borrowed USDG may go to (16 at most)”
- gas_stationboolean“New line: put the agent's gas station on the allowlist, so the agent can borrow its own gas (credit_gas)”
- billsboolean“New line: bill pay, the agent's own wallet on the allowlist, so it can borrow what it is short of an x402 bill (credit_bill); the line then needs a daily limit…”
- keeperstring“New line: "borro" (Borro's keeper, the default), "none", or an address”
- sell_bpsinteger“New line: most of the credits one protect sale may sell, in hundredths of a percent (0 to 2500; CREDIT default 2500; 0 in a market with no pool)”
- slip_bpsinteger“New line: most a protect sale may fill under the feed's price, in hundredths of a percent (0 to 1000, default 300)”
credit_pay
“One unsigned borrow from a line straight to a payee on its allowlist (or its owner): the line's agent or owner signs it, the USDG goes from Morpho to the payee, and the line owes it until repaid.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
4 inputs, 4 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- accountstringrequired“The line's address”
- tostringrequired“The payee: an address on the line's allowlist, or its owner”
- amountstringrequired“USDG to pay, in whole units as a decimal string, like "1.5"”
credit_gas
“Unsigned transactions that turn a line's credit into ETH in its agent's own wallet: make the agent's gas station if it has no code yet (anyone may; the station is the GasStationFactory's predict of t…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
3 inputs, 2 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- accountstringrequired“The line's address”
- amountstring“USDG to borrow to the agent's gas station (optional; without it, pump what the station holds), in whole units as a decimal string, like "1.5"”
credit_bill
“Pay a merchant's x402 bill (HTTP 402 Payment Required) in USDG on Robinhood Chain from an agent credit line.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
4 inputs, 3 required
- walletstringrequired“The payer's address (0x...): the line's agent, or its owner”
- accountstringrequired“The line's address”
- payment_requiredstring or objectrequired“The merchant's 402: its PAYMENT-REQUIRED header value (base64), or its JSON body”
- max_usdgstring“The most to pay for this one bill (optional; refused above it), in whole units as a decimal string, like "1.5"”
credit_bill_header
“After credit_bill and the wallet's signature: the header the merchant reads (PAYMENT-SIGNATURE, or X-PAYMENT for x402 version 1), base64 JSON with the authorization and signature.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
3 inputs, 3 required
- payment_requiredstring or objectrequired“The same payment_required given to credit_bill”
- authorizationobject or stringrequired“The authorization credit_bill returned, as it returned it”
- signaturestringrequired“The wallet's signature of credit_bill's typed_data (0x hex)”
credit_repay
“Unsigned transactions repaying a line's USDG debt from the wallet (anyone may): an amount, or amount "all"; exact USDG approval to the line first (all: the debt plus a hundredth of a percent for inte…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
8 inputs, 2 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- accountstringrequired“The line's address”
- amountstring“USDG to repay, or "all", in whole units as a decimal string, like "1.5"”
- closeboolean“The owner: repay everything and take every credit back”
- unwindboolean“The owner: sell the line's CREDIT into its debt, no USDG needed”
- sellstring“With unwind: CREDIT to sell, or "all" (default: enough for the whole debt), in whole units as a decimal string, like "1.5"”
- min_usdgstring“With unwind: the least USDG the sale must bring (default: the whole debt when selling all or the default amount, else 97% of the pool's price), in whole units …”
- then_closeboolean“With unwind: close the line after (default true when the sale covers the debt)”
credit_guardrails
“One unsigned configure() transaction for the line's owner, starting from the line's current settings: agent (or revoke_agent: true, a JSON boolean, at once; never the owner's own wallet), keeper ("bo…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
17 inputs, 2 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- accountstringrequired“The line's address”
- agentstring“A new agent address”
- revoke_agentboolean“Revoke the agent at once”
- keeperstring“"borro", "none" or an address”
- ceilingstring“The most USDG the line may owe, in whole units as a decimal string, like "1.5"”
- daily_limitstring“The most USDG out in any 24 hours, like "100", or "none"”
- target_ltvnumber or string“Target LTV, a fraction under 1 like 0.18 or a percent with its sign like "18%"”
- trigger_ltvnumber or string“Protect trigger LTV, at or above the target, like 0.27 or "27%"”
- sell_bpsinteger“0 to 2500 (0 in a market with no pool)”
- slip_bpsinteger“0 to 1000”
- allowarray“Addresses to add to the allowlist”
- denyarray“Addresses to take off it”
- gas_stationboolean“true: put the agent's gas station on the allowlist; false: take it off”
- billsboolean“true: bill pay, the agent's own wallet on the allowlist (credit_bill); false: take it off”
- transfer_tostring“The owner: offer the line to this address (it becomes theirs when they accept)”
- acceptboolean“The wallet the line is offered to: accept it, then name Borro's keeper again”
hold_open
“Unsigned transactions putting part of the wallet's Borro position on hold for one payee, up to a cap in USDG and until an expiry, while the shares keep earning (the vault's interest or lending fees, …”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
13 inputs, 1 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- payeestring“Who the hold pays (or give payment_required)”
- payment_requiredstring or object“A merchant's 402 PaymentRequired (its PAYMENT-REQUIRED header value or JSON body) offering borro-hold”
- capstring“The most USDG the payee can ever be paid from the hold, in whole units as a decimal string, like "1.5"”
- vaultstring“"USDG" (default) or a stock's ticker, like NVDA”
- usdgstring“USDG hold: the USDG to put in (default: the cap and 0.000002 for the vault's rounding), in whole units as a decimal string, like "1.5"”
- sharesstring“Stock (or bUSDG) hold: the vault shares to hold, like "0.5", or "all"”
- expiry_secondsinteger“How long the hold lasts, in seconds (60 to 7776000)”
- modestring“metered (default) or charge”
- operatorstring“Charge mode: an address that may charge and release for the payee”
- saltstring“32 bytes of 0x hex for the hold's id (default: fresh)”
- max_slip_bpsinteger“The most slippage the payer accepts on a stock hold's sales, in basis points (default: the listing's now)”
- max_fee_bpsinteger“The most fee the payer accepts, in basis points (default: BorroHolds' fee now)”
hold_pay
“The voucher for one x402 request (HTTP 402 offering the borro-hold scheme): the typed data the hold's payer signs, saying what it owes the merchant in all on the hold, counted on from the last vouche…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
4 inputs, 1 required
- payment_requiredstring or objectrequired“The 402's PaymentRequired (PAYMENT-REQUIRED header value or JSON body)”
- holdstring“The hold's id (hold_open returned it)”
- walletstring“The payer: finds its hold for this merchant when hold is not given”
- max_usdgstring“The most one request may cost, in whole units as a decimal string, like "1.5"”
hold_header
“After hold_pay and the payer's signature: the header the merchant reads (PAYMENT-SIGNATURE, or X-PAYMENT for x402 version 1), base64 JSON with the voucher { hold, cumulative, signature }.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
3 inputs, 3 required
- payment_requiredstring or objectrequired“The same payment_required given to hold_pay”
- voucherobject or stringrequired“The voucher hold_pay returned, as it returned it”
- signaturestringrequired“The payer's signature of hold_pay's typed_data (0x hex)”
hold_status
“A hold on BorroHolds by its id, or the newest 10 a payer opened or that pay a payee: payer, payee, vault, mode, cap, paid, shares and their value in USDG, the cover, the expiry and the payee's 4-day …”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
3 inputs
- holdstring“A hold's id”
- payerstring“A payer's address”
- payeestring“A payee's address”
hold_collect
“One unsigned transaction paying a hold's payee.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
6 inputs, 2 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- holdstringrequired“The hold's id”
- cumulativestring“Metered: the voucher's cumulative, in USDG's smallest units”
- signaturestring“Metered: the voucher's signature”
- amountstring“Charge mode: USDG to charge, in whole units as a decimal string, like "1.5"”
- in_sharesboolean“Pay the payee the vault's shares worth the amount (a stock hold's divided by one plus the constant 0.5% (PAD_BPS, 50 bps) pad; the payee or its operator)”
hold_end
“One unsigned transaction ending a hold: release (its payee or operator, any time) or, after the expiry and the payee's 4-day grace, reclaim (anyone).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
2 inputs, 2 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- holdstringrequired“The hold's id”
account_open
“Unsigned transaction opening the wallet's trade account (a TradeAccount, one per owner, made by TradeAccountFactory), naming an agent if given: an optional second key, never the wallet itself, that c…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
9 inputs, 1 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- agentstring“The agent's address (optional): a second key that may trade the account and set triggers, never the wallet itself”
- revoke_agentboolean“With an account open: revoke its agent at once”
- agent_slip_bpsinteger“The most the agent's trades and triggers may price from the feed, in hundredths of a percent (100 to 300, default 100)”
- agent_max_tip_bpsinteger“The most tip the agent's triggers may pay executors (a share of the closed notional at the feed, capped (tip_bps, at most 50 basis points, and never more than …”
- agent_max_margin_usdgstring“The most equity one position may hold after the agent's trade, or "none" (default none), in whole units as a decimal string, like "1.5"”
- agent_daily_loss_usdgstring“The most the agent's fills (and the fires of the triggers it set) may cost against the feed in all each UTC day, renewed at 00:00 UTC (default 0: no agent open…”
- agent_restrictedboolean“true: the agent opens on the desks the owner allows (setAgentMay) alone”
- max_slip_bpsinteger“How far a stop's or a guard's fire bound may widen past its slip over time, in hundredths of a percent (0: no further, up to 1000)”
account_trade
“Unsigned transactions to open or close a short or a leveraged long through the trade account: the same trades as open_short, close_short, open_long and close_long, with the account as the trader.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
10 inputs, 3 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- accountstring“A trade account's address (default: the wallet's own, as its owner; an agent gives its owner's account)”
- actionstringrequired“open_short, close_short, open_long or close_long”
- symbolstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
- amountstring“open_short: stock to short, in whole units as a decimal string, like "1.5"”
- depositstring“open_short: USDG held beyond the sale (optional), in whole units as a decimal string, like "1.5"”
- marginstring“open_long: USDG margin, in whole units as a decimal string, like "1.5"”
- leveragenumber“open_long: leverage, more than 1, like 1.5”
- percentnumber“close_long: how much to close, 1 to 100 (default 100)”
- fund_from_walletboolean“The agent signing: true to send its own USDG into the owner's account when the account holds too little (it becomes the owner's; it can go out to the owner alo…”
trigger_set
“Unsigned transaction leaving an order on a position in the trade account, which anyone may execute once the price feed confirms it, for a tip.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
12 inputs, 4 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- accountstring“A trade account's address (default: the wallet's own, as its owner; an agent gives its owner's account)”
- symbolstringrequired“A stock on Borro by its ticker, like NVDA or AAPL (markets lists every one)”
- sidestringrequired“short (the account's short on the stock) or long (its leveraged long)”
- kindstringrequired“stop (stop-loss), take (take-profit) or guard (liquidation guard)”
- pricestring“stop or take: the stock's feed price in dollars that fires it, like "190.5"”
- percentnumber“stop or take: how much of the position to close, more than 0 to 100 (default 100)”
- ltvnumber or string“guard: the LTV it fires at, a fraction like 0.55 or a percent with its sign like "55%"”
- targetnumber or string“guard: the LTV it closes down to, under ltv”
- slip_bpsinteger“The most the close may come in worse than the feed's price, in hundredths of a percent (100 to 300, default 100)”
- tip_bpsinteger“The executor's tip, a share of the closed notional at the feed, capped (tip_bps, at most 50 basis points, and never more than the USDG the close returns), in h…”
- expiry_secondsinteger“How long it stays live, in seconds (0 or left out: until cancelled; at most a year)”
trigger_list
“The live triggers on a trade account (account, or the wallet's own): each with its condition in words, the stock's price now and how far it is from firing (in dollars and percent; a guard's LTV now a…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
2 inputs
- accountstring“A trade account's address (default: the wallet's own, as its owner; an agent gives its owner's account)”
- walletstring“The account's owner (when account is not given)”
trigger_cancel
“Unsigned transaction cancelling a live trigger on the trade account: the owner cancels any, the agent the ones it set.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
3 inputs, 2 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- accountstring“A trade account's address (default: the wallet's own, as its owner; an agent gives its owner's account)”
- idstringrequired“The trigger's number (trigger_list shows it)”
trigger_fire
“For executor agents: the triggers that hold right now by the account's own check (on one account, read on chain; or across every trade account as Borro's keeper publishes them at /triggers.json each …”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
3 inputs, 1 required
- walletstringrequired“The executor's address (any address; the tip goes to it)”
- accountstring“One trade account (optional; default every account)”
- idstring“With account: one trigger's number”
account_statuson 22 other servers
“A trade account (account, or the wallet's own): its owner, its agent and the agent's limits (with today's loss against its daily loss budget and what that still lets the agent do: opens, deposit with…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
2 inputs
- accountstring“A trade account's address (default: the wallet's own, as its owner; an agent gives its owner's account)”
- walletstring“The account's owner (when account is not given), or a wallet to say whether it is the owner or the agent”
account_withdraw
“Unsigned transaction taking money out of the trade account: USDG (the default), a stock by its ticker or any token by its address, an amount or all: true.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
6 inputs, 1 required
- walletstringrequired“The wallet's address (0x...); the transactions are built for it to sign”
- accountstring“A trade account's address (default: the wallet's own, as its owner; an agent gives its owner's account)”
- tokenstring“USDG (default), a stock's ticker, or a token's address”
- amountstring“How much to take out, in whole units as a decimal string, like "1.5"”
- allboolean“Everything the account holds of it”
- tostring“Where it goes (default the owner; the agent may send to the owner alone)”

Each quoted sentence is the first sentence of the publisher’s own description. The kind of tool and the “changes data” mark are our AI model’s reading of that description, not something we tested: two differently worded runs had to agree, otherwise no label is shown, and nobody has checked them by hand. A tool without the “changes data” mark is described as only reading, searching or calculating, or the two runs did not agree. No tool was called. Read the publisher’s full description before relying on it. “Publisher declares” lists the hints the server itself sends with the tool (MCP annotations: read-only, destructive, idempotent, open-world); they are the publisher's claims, not checked by us. Inputs are the parameters in the tool's own input schema: name, declared type, whether it is required, and the first sentence of its description. Read 2026-10-28.

How well are its tools described?

Features #4 and #5

How clearly this server's own tool descriptions say what a tool does, and how consistent its tool list is. The first part is an AI model's yes/no reading of each description; the second part is counted. We do not turn it into a grade.

Descriptions

AI reading of each description

No AI reading was available for this server's tools (the two runs did not agree, or the listing was not reviewed).

Counted from the listing

Parameters with a description: 100% of 251
Tools with a description: 100% of 61
Typical description length: 626 characters

The tool set

Counted from the listing

Tools: 61
Size of the list: about 20,971 tokens for an agent to load (characters ÷ 4)
Naming: 47 of 61 names use snake_case

AI reading: easy to mix up

No pair found.

The AI items cover 0 of 61 tools: for a tool where two differently worded runs disagreed, that item is left out. They were not checked by hand, and no tool was called. “Easy to mix up” means two tools whose names or descriptions overlap without saying how they differ; the AI found none, comparing tools within groups of 40. We do not rate whether the tool set is complete or whether side effects are spelled out, because our AI reading of those was not reliable enough.

How do I add it to my client?

Config from the registry entry

From the remote endpoint (Streamable HTTP)

We connected to this URL on 2026-10-28 (a read-only session: no tool was called).

Add to CursorAn install link in the format Cursor documents, holding the Cursor config below.

Claude Desktop or claude.ai

Settings → Connectors → Add custom connector, then paste:
https://borro.markets/mcp

Cursor · .cursor/mcp.json in a project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "borro": {
      "url": "https://borro.markets/mcp"
    }
  }
}

VS Code · .vscode/mcp.json

{
  "servers": {
    "borro": {
      "type": "http",
      "url": "https://borro.markets/mcp"
    }
  }
}

VS Code (command line) · Bash or zsh terminal (macOS, Linux)

code --add-mcp '{"name":"borro","type":"http","url":"https://borro.markets/mcp"}'

Claude Code

claude mcp add --transport http borro https://borro.markets/mcp

Cline · cline_mcp_settings.json (Cline CLI: ~/.cline/data/settings/; in the editor: MCP Servers → Configure → Configure MCP Servers)

{
  "mcpServers": {
    "borro": {
      "type": "streamableHttp",
      "url": "https://borro.markets/mcp",
      "disabled": false,
      "autoApprove": []
    }
  }
}

Gemini CLI · ~/.gemini/settings.json, or .gemini/settings.json in a project

{
  "mcpServers": {
    "borro": {
      "httpUrl": "https://borro.markets/mcp"
    }
  }
}

OpenAI Codex · ~/.codex/config.toml, or .codex/config.toml in a trusted project

[mcp_servers.borro]
url = "https://borro.markets/mcp"

Zed · Zed settings file (command: zed: open settings file)

{
  "context_servers": {
    "borro": {
      "url": "https://borro.markets/mcp"
    }
  }
}

Try it in the MCP Inspector · runs on your machine, opens in your browser · Node 22.19+

npx @modelcontextprotocol/inspector@2.11.0 --server-url https://borro.markets/mcp --transport http

The server runs on the operator's infrastructure; it may ask you to sign in when you first connect.
Zed's docs we read on 2026-10-26 describe remote servers by URL and do not name the transport.
The MCP Inspector lists the server's tools, resources and prompts; a tool you call there runs for real.

Built from the server's registry entry with each client's documented format (checked 2026-10-14; the Cursor link and the VS Code command 2026-10-19; the MCP Inspector command 2026-10-21; Cline, Gemini CLI, OpenAI Codex and Zed 2026-10-26). Values in < > are yours to fill in; this page never contains a key. Where the server needs a setting the entry does not declare, it can still fail to start.

Does the registry listing match what we found?

Feature #6

The registry verifies a package once, when it is published, and does not re-check it. A difference below is about the listing, not a judgement of the publisher.

Registry says	We found	Result	Source · date
Remote endpoint borro.markets/mcp	Session opened	matches	our test · 2026-10-28
No credential declared as required	Opened a session without any credential	matches	our test · 2026-10-28

Choosing

Record checks

Public records · not a safety rating

1 of 2 record checks met · 7 do not apply

Not ranked by downloads: a remote server publishes no download figure
Not ranked by stars: no public GitHub repository

MetRegistry entry is active and says how to run itActive, with a package or a remote address.
Not metSource repository link opensThe registry entry gives no repository link.
Does not applyRepository is not archivedNo public GitHub repository to read.
Does not applyCode pushed to the repository in the 90 days before our checkNo public GitHub repository to read.
Does not applyRepository publishes a security policy (SECURITY.md)No public GitHub repository to read.
Does not applyPackage names its licence with a standard (SPDX) identifierRemote server: it ships no package.
Does not applyThe version the registry lists can be installed and is not withdrawnRemote server: it ships no package.
Does not applynpm package carries build provenance (attestation)Remote server: it ships no package.
Does not applyNo known critical or high advisory in the package or its dependenciesRemote server: it ships no package.

Read from public records only: the registry entry, npm/PyPI, GitHub and advisory databases, checked 2026-10-28. No tool was called. Only “met” and “not met” are counted, so the total differs between servers; a check that does not apply or that we could not run is listed, never counted against it. It is not a safety rating. How each check works · Leaderboards

Common questions about markets.borro/borro

Answered from the data above

Who publishes markets.borro/borro?

The registry ties the namespace markets.borro to the domain borro.markets; only its owner can publish under it. These are facts from the registry and GitHub, not a rating.

Does markets.borro/borro need an API key or sign-in?

It opened a session without any credential on 2026-10-28. The registry entry declares no required credential; no declaration is not a guarantee.

Has markets.borro/borro been security tested?

Partly. 2 of the 14 checks that apply to it were exercised. We connected and read what the server declares, but did not call its tools: ProtocolProbe calls no server's tools for anything it publishes. This is our choice, not a block by the server. No security verdict is published before verification.

Found this page useful?

Anonymous · no sign-in

A quick, anonymous reaction — no account, no email. One per kind from your browser. The tally updates when the page is next refreshed, and it is only a rough count, never a safety rating or a measured number of people.

Compare with another server

Side by side: registry entry, our read-only session, the tools and the 18 classification fields. Same values as each page; no score.

Security testing

What did we test, and what did we leave out?

18 checks · features #1, #2

Not probed (we call no server's tools)

We connected and read what the server declares, but did not call its tools: ProtocolProbe calls no server's tools for anything it publishes. This is our choice, not a block by the server. No security score is given; a check we did not run is never counted as passed.

The 18 checks at a glanceour test · 2026-10-28

Inventory: exercised
Hidden instructions: exercised
Real execution: not run · our policy
Secret leak: not run · nothing to check it against
Internal addresses: not run · our policy
Unconfirmed changes: not run · our policy
Bad input: not run · our policy
Model requests: not run · nothing to check it against
Sensitive questions: not run · nothing to check it against
Folder boundary: not run · our policy
Log leaks: not run · nothing to check it against
Hidden content: not run · nothing to check it against
Fake assistant turns: not applicable
Token passthrough: not applicable
Token audience: not applicable
Sign-in redirect: not run · our policy
Consent handling: not testable from outside
Sign-in metadata: not applicable

2 exercised12 not run (reason given)4 not applicable

Each check ends in exactly one state: exercised, not run (with the reason), or not applicable (with the reason). 2 of the 14 checks that apply to it were exercised. We do not publish security-check outcomes for named servers.

Exercised · 2

1Inventory
tool-listReads the declared tools, resources and prompts.exercised
2Hidden instructions
description-poisoningLooks for hidden instructions in tool descriptions.exercised

Not run, with the reason · 12

3Real execution
real-executionCalls a tool and checks what really happens.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
4Secret leak
canary-leakPlants a fake secret and checks whether it leaks.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
5Internal addresses
ssrfChecks whether a tool can be steered to internal addresses.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
6Unconfirmed changes
write-without-confirmationChecks whether tools that change data act without asking.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
7Bad input
error-handlingSends bad input and watches how the server answers.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
8Model requests
samplingChecks whether the server asks the client's model to act for it.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
9Sensitive questions
elicitation-sensitive-dataChecks whether the server asks users for sensitive data.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
10Folder boundary
root-boundaryChecks whether the server reaches outside the folders it was given.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
11Log leaks
logging-side-channelChecks whether log messages carry data they should not.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
12Hidden content
audience-hidingChecks resources that hide content from the user.This check needs content the server returns, and nothing was read or called.not run · nothing to check it against
16Sign-in redirect
open-redirectChecks the sign-in redirect for abuse.Testing the sign-in redirect means sending probes to the operator's sign-in service, which we do not do.not run · our policy
17Consent handling
confused-deputyChecks consent handling when one service acts for another.Depends on the operator's own consent screen, which differs per server and cannot be tested from outside.not testable from outside

Does not apply to this server · 4

13Fake assistant turns
fake-assistant-turnChecks prompts that pose as the assistant's own words.The server exposes no prompts.not applicable
14Token passthrough
token-passthroughChecks whether the server forwards a user's token to other services.The server opened a session without sign-in, so there is no token flow to check.not applicable
15Token audience
token-audience-validationChecks whether tokens meant for another service are accepted.The server opened a session without sign-in, so there is no token flow to check.not applicable
18Sign-in metadata
oauth-url-schemeChecks the published sign-in metadata for unsafe URLs.No sign-in (OAuth) metadata is published, so there are no sign-in addresses to check.not applicable

Source: our own test, 2026-10-28, mcp-runtime-engine@0.1.0. Which checks count and why follows our published scoring model.

What happened during the test?

Feature #8

The steps in order, as the test record holds them.

0 msStarted a read-only session with the server's remote endpoint
547 msConnected after 0 redirects. No credential was sent or needed.
Read the inventory: 61 tools, 0 resources, 0 prompts.
1,786 msFinished: 2 checks exercised.

Reference

How is it classified?

18 fields

One value per field, each with its source. Fields written by AI models are marked. A field with no value says why.

TopicAI-classified

pending: added in the weekly update

listed 2026-10-28; not classified yet

Pricing modelAI-classified

pending: added in the weekly update

the website is not read yet

Programming language

does not apply

no existing GitHub repository (server declares no repository link, so there is nothing to fetch)

Hosting type

remote (hosted by the publisher)

registry · 2026-10-28

MCP capability

tools

our test · 2026-10-28

Transport

streamable HTTP

registry · 2026-10-28

Required credentials

none declared

registry · no declaration is not a guarantee

Package registry

does not apply

remote-only server: no package is shipped, so there is no package registry

Freshness

0–30 days

registry updatedAt · 2026-10-28

Lifecycle status

active

registry · 2026-10-28

License class

does not apply

remote-only server: ships no package, so there is nothing to look up in a package registry

Integrity hash

does not apply

remote-only server: ships no package, so there is nothing to look up in a package registry

Signature / provenance

does not apply

remote-only server: ships no package, so there is nothing to look up in a package registry

Dependency advisories

does not apply

ships no package, so there are no dependencies to audit

Popularity

does not apply

remote-only server: ships no package, so there is nothing to look up in a package registry

Publisher signals

not stated

no readable GitHub owner to describe

Maintenance

does not apply

server declares no repository link, so there is nothing to fetch

Environment

the publisher's infrastructure

where it runs, from the hosting type

“Not stated” means the source did not state it; “does not apply” means it does not apply to this kind of server; “our limit” means our own lookup failed. A linked value opens the directory filtered to the same value.

Cite or correct this page

Sources and corrections

Suggested citation

ProtocolProbe. “markets.borro/borro: MCP server record.” Data checked 2026-10-28. https://protocolprobe.com/mcp/servers/markets.borro/borro

Figures are valid for the date shown. Our facts on this page are CC BY 4.0: reuse them with a link and the check date. Quoted text (the publisher’s descriptions, website quotes, tool names) is not ours to license.

As JSON: this record in the API · API documentation.

Badge for your README

[![ProtocolProbe](https://protocolprobe.com/api/v1/badge/markets.borro/borro)](https://protocolprobe.com/mcp/servers/markets.borro/borro)

It shows this server's record-check count: facts from public records, no tool called. It is not a security rating or a pass. It links here and updates after each data reload.

Something wrong, or is this yours?

If a fact here is wrong, tell us and we will re-check it. If you operate this server, you can run our checks on it yourself with the free self-test command; we call no server’s tools ourselves for anything shown here.

Write to hello@protocolprobe.com · corrections log · methodology