mangrove-agent

Use when the user wants to backtest an existing strategy — "run a backtest on X", "how would this have done", "verify this strategy", or after /create-strategy produces a draft that needs evaluation. Sizes the window from a target bar count (not a fixed month table), caps against data availability, reports a verdict against `threshold_spec.json` plus benchmark deltas, and recommends the next action (promote, iterate, reject). Wraps `backtest_strategy` + `get_market_data` + optionally `list_ohlcv_coverage` (when available) for the SDK consumer — no manual date math.

Use when the user wants to connect their own Kraken account to trade on it through the agent — "set up Kraken", "connect my Kraken", "trade on Kraken", "add/use my Kraken API key", "I want to trade on a CEX", or when moving toward live centralized-exchange trading on Kraken. Guides the user to create a LEAST-PRIVILEGE Kraken API key, store it securely without ever pasting it in chat, and explains the local bring-your-own-key (BYOK) model: the client-side SDK connects to Kraken DIRECTLY with the user's key — the key stays on the user's machine and never reaches a Mangrove server. The keyless OAuth path (Mangrove holds the grant and submits on the user's behalf, server-side) is the sibling `connect-kraken` skill, NOT this one — offer it when the user doesn't want to create or manage an API key.

Check if a proposed change aligns with mangrove-agent's stated principles, architecture, and trading-bot safety invariants. Use when the user describes a change and asks "does this fit", "check alignment", "review this approach", or "/check-alignment <description>". Read-only analysis — does NOT modify anything. Adapted from the Mangrove workspace `check-alignment` skill with trading-bot-specific documents.

Draft an MCP tool specification for an mangrove-agent extension. Use when the user asks to "draft an MCP tool", "spec out a new tool", "add a tool for X", or "/tool-spec <purpose>". Produces a JSON-schema-shaped spec that matches the mangrove-agent service-layer pattern and auth-tier conventions, ready to paste into `server/src/mcp/tools.py`. Adapted from the Mangrove workspace `tool-spec` skill with mangrove-agent conventions.

Use when the user wants to connect their Kraken account to trade through the agent WITHOUT creating or handling an API key — "connect Kraken with OAuth", "log in with Kraken", "connect Kraken without a key", "I don't want to manage a Kraken key". This is the KEYLESS (OAuth) mode: the user consents once in a browser and the Mangrove platform holds the grant and trades on their behalf. It is the sibling of the BYOK `setup-kraken` skill — if the user is willing to create and hold their own key locally, use setup-kraken instead; if they want Mangrove to manage access, use this.

Use when the user has MANY candidate strategies (or wants to try many parameter variations) and needs to know which are worth the cost of a backtest — "score these", "which of these should I test", "pre-filter my candidates", "rank these MACD variations". Also the natural next step after /create-strategy or /custom-signal produces a candidate set. Scores up to 99 candidates in ONE millisecond-cheap call through the Mangrove SIEVE classifier, drops the dead-on-arrival ones (binary head), and ranks the survivors by P(winning) (4-class head) — a cheap SCREEN, never a verdict. Wraps `sieve_score` + `oracle_list_signals`, hands the shortlist to /backtest (one winner) or /backtest/bulk (several). This screens a FIXED candidate list; for a parameter-space SEARCH that generates its own candidates, use /sweep instead.

Use when the user wants to search a parameter SPACE at scale rather than test one config — "sweep the RSI window from 7 to 21", "try every MACD variation on BTC 1h and rank them", "what's the best config for X", "run an experiment", "hyperparameter search". Drives the managed Oracle experiment lifecycle (create → validate → launch → poll → results): you give it a strategy template + a parameter space, and the ENGINE generates and backtests the candidates (grid or random/ Monte-Carlo), ranking the results. A binary SIEVE pre-filter skips dead configs during the sweep. Wraps `oracle_list_datasets` + `oracle_list_signals` + `oracle_create_experiment` + `oracle_validate_experiment` + `oracle_launch_experiment` + `oracle_get_experiment` + `oracle_list_results`; hands the winner to /backtest for a confirming verdict before paper/live.

Run a focused security audit of the mangrove-agent trading bot. Covers wallet signing surfaces, EIP-7702 / arbitrary-signing risks, MCP tool permissions, Fernet key handling, DEX executor paths, hook-enforcement gaps, OWASP Top 10, and dependency CVEs. Use when the user asks for "security audit", "audit security", "security review", "check for vulnerabilities", "OWASP audit", or "/audit-security". Adapted from the Mangrove workspace `audit-security` skill with a trading-bot lens added after the 2026-04-24 EIP-7702 incident.

Build a custom signal stack (entry and/or exit) for a trading strategy by composing atomic signals from the Mangrove signal library. Use when the user describes a rule in natural language that doesn't match a curated reference — "buy when RSI is low and volume spikes", "exit when price drops below 20 EMA", "only enter when ADX > 25 filter is true" — OR when `/create-strategy` Phase C territory is hit. Outputs a `create_strategy_manual`-compatible `entry` and/or `exit` payload ready to hand off to `/backtest`.

Use when the user wants to build a new trading strategy — "build me a momentum play on ETH", "find a strategy for BTC", "I want to trade X", "make a strategy", or after Stage 0 greeter when the wallet is ready and the user is moving into Stage 2 (Author) of trading-bot-workflow.md. Drives the author → backtest path using reference strategies (Mechanism 2) and KB-grounded parameter choices (Mechanism 1) so parameters are evidence-backed, not library-default guesses. Wraps search_reference_strategies + build_strategy_from_reference + create_strategy_autonomous + create_strategy_manual + kb_search.

Use when the user asks about interacting with the app's API — querying data, creating resources, checking status. This skill covers all MCP tools and REST endpoints exposed by the server.