HKUDS/Vibe-Trading · error · ValueError

Live-broker MCP server '{server_key}' may not use a wildcard

Error message

Live-broker MCP server '{server_key}' may not use a wildcard {detail}

What it means

Raised by validate_live_broker_servers when a server keyed as a live broker (e.g. Robinhood) uses a wildcard where an explicit allowlist is required — for instance a wildcard tool allowlist/pattern. Live money-moving servers must be narrowly scoped, and when the server is Robinhood the message also embeds format_robinhood_mcp_config_guidance(reason='wildcard') with remediation steps.

Source

Thrown at agent/src/config/schema.py:499

        Returns:
            The validated agent config instance.

        Raises:
            ValueError: If a live-broker server entry uses ``["*"]``.
        """
        for server_key, server in self.mcp_servers.items():
            if is_live_broker_entry(server_key, server) and "*" in server.enabled_tools:
                if _allows_readonly_wildcard_probe(server_key, server):
                    continue
                broker = live_broker_key_for_entry(server_key, server)
                if broker == "robinhood":
                    detail = (
                        f"{LIVE_BROKER_WILDCARD_ALLOWLIST_ERROR}. "
                        f"{format_robinhood_mcp_config_guidance(reason='wildcard')}"
                    )
                else:
                    detail = LIVE_BROKER_WILDCARD_ALLOWLIST_ERROR
                raise ValueError(
                    f"Live-broker MCP server '{server_key}' may not use a wildcard {detail}"
                )
        return self


class AgentConfigOverride(ConfigBase):
    """Partial top-level config override used for runtime layering."""

    model_config = ConfigDict(
        alias_generator=_to_camel,
        populate_by_name=True,
        # Load-bearing: SessionService passes the entire session.config dict
        # (which carries unrelated keys like include_shell_tools) through
        # merge_agent_config_overrides.  Flipping this back to "forbid" makes
        # any such payload raise ValidationError and silently drops the whole
        # override, including any valid mcpServers.  Regression test:
        # tests/test_agent_config.py::
        #   test_runtime_load_preserves_mcp_servers_when_opted_in_with_unknown_keys

View on GitHub (pinned to 80ffdda44c)

Solutions

1. Replace the wildcard with an explicit allowlist of the specific broker tools you need (read-only quotes/positions first).
2. If the error text includes Robinhood guidance, follow the embedded configuration guidance for the correct seed config.
3. Keep live-broker servers pinned to a reviewed, minimal tool set before enabling trading.

Example fix

# before
mcp_servers:
  robinhood:
    # wildcard tools config

# after
mcp_servers:
  robinhood:
    # explicit allowlist: quote, positions, orders_read

def broker_entry_explicit(entry: dict) -> bool:
    # reject wildcard tool allowlist patterns for live-broker servers
    tools = entry.get('tools') or entry.get('allowlist')
    if tools is None:
        return True
    return not any('*' in str(t) or t == '*' for t in tools)

When it happens

Trigger: Declaring a live-broker MCP server (by its server_key) whose config contains a wildcard entry (tools/allowlist patterns) that policy forbids for brokers.

Common situations: Reusing a generic wildcard-enabled MCP template for a Robinhood/IBKR live server; disabling allowlists for convenience during integration testing and forgetting to restore them.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• OAuth MCP servers require an https url
• HTTP MCP servers require an explicit type of 'sse' or 'strea
• stdio MCP servers require a command
• stdio MCP servers do not accept url/headers
• stdio MCP servers do not accept auth (OAuth is HTTP-only)

AI-assisted analysis of HKUDS/Vibe-Trading@80ffdda44c (2026-08-28). Data as JSON: /api/errors/fb3fefea262cba5e. Report an issue: GitHub.