Polycopy
Automated copy trading bot for Polymarket prediction markets. Security-hardened fork with kill switch, preview mode, Telegram alerts, Web UI, REST API, MCP server. Zero external DB (NeDB). Docker ready (189MB).
Ask AI about Polycopy
Powered by Claude ยท Grounded in docs
I know everything about Polycopy. Ask me about installation, configuration, usage, or troubleshooting.
0/500
Reviews
Documentation
English | ็ฎไฝไธญๆ | ็น้ซไธญๆ | ๆฅๆฌ่ช
PolyCopy
Automated copy trading bot for Polymarket prediction markets
โ ๏ธ Security Note: This project was forked from a malicious repository that contained hidden private key theft code. All malicious code has been removed, audited 3 times, and the project has been completely rewritten with security-first design. See Security for details.
โจ Features
- Multi-Trader Copy Trading โ Track and mirror trades from multiple top Polymarket traders simultaneously
- 3 Copy Strategies โ Percentage, Fixed, or Adaptive sizing with tiered multipliers
- Kill Switch Protection โ Automatic daily loss cap stops trading when threshold is exceeded
- Preview Mode โ Dry-run mode to test without risking real funds
- Trade Aggregation โ Combines small trades into larger executable orders
- Position Tracking โ Accurate buy/sell tracking even after balance changes
- Web Dashboard โ Real-time monitoring UI with dark theme and multi-language support
- REST API + Swagger โ Full API with interactive documentation at
/docs - MCP Server โ Model Context Protocol integration for AI assistant access
- Telegram Notifications โ Trade execution, kill switch, and error alerts
- Zero External DB โ Uses NeDB (local file storage), no MongoDB needed
- Docker Ready โ Single container, 189MB, all-in-one deployment
๐ Quick Start
Option 1: Docker (Recommended)
# Pull and run
docker run -d --name polycopy \
-p 3000:3000 \
-v polycopy_data:/app/data \
--env-file .env \
neosun/polycopy:latest
# Open dashboard
open http://localhost:3000
Option 2: From Source
git clone https://github.com/neosun100/polycopy.git
cd polycopy
npm install
cp .env.example .env # Edit with your settings
npm run build
npm start # Bot + Web UI on port 3000
โ๏ธ Configuration
Copy .env.example to .env and configure:
# Required
USER_ADDRESSES='0xTraderAddress1,0xTraderAddress2' # Traders to copy
PROXY_WALLET='0xYourWalletAddress' # Your wallet
PRIVATE_KEY='your_64_hex_private_key' # No 0x prefix
RPC_URL='https://polygon-mainnet.infura.io/v3/KEY' # Polygon RPC
# Strategy (defaults shown)
COPY_STRATEGY='PERCENTAGE' # PERCENTAGE | FIXED | ADAPTIVE
COPY_SIZE=10.0 # 10% of trader's order
MAX_ORDER_SIZE_USD=100.0 # Max per trade
SLIPPAGE_TOLERANCE=0.05 # Max price deviation
# Safety
DAILY_LOSS_CAP_PCT=20 # Kill switch at 20% daily loss
PREVIEW_MODE=false # Set true to test without trading
# Optional
TELEGRAM_BOT_TOKEN='...' # From @BotFather
TELEGRAM_CHAT_ID='...' # Your chat ID
See .env.example for all options including tiered multipliers and trade aggregation.
๐ฅ๏ธ Access Modes
| Mode | URL | Description |
|---|---|---|
| Web UI | http://localhost:3000 | Dashboard with trade monitoring |
| Swagger | http://localhost:3000/docs | Interactive API documentation |
| REST API | http://localhost:3000/api/* | Programmatic access |
| MCP | stdio | AI assistant integration |
MCP Configuration
{
"mcpServers": {
"polycopy": {
"command": "node",
"args": ["dist/mcp/server.js"]
}
}
}
Available MCP tools: get_bot_status, get_recent_trades, get_positions, get_config
๐๏ธ Project Structure
polycopy/
โโโ src/
โ โโโ config/ # Environment & strategy configuration
โ โโโ interfaces/ # TypeScript type definitions
โ โโโ models/ # NeDB data models
โ โโโ server/ # Express.js Web UI + API
โ โโโ services/ # Trade monitor & executor
โ โโโ mcp/ # MCP server
โ โโโ utils/ # Core utilities (orders, balance, logging)
โ โโโ scripts/ # CLI tools (health check, simulation, etc.)
โ โโโ __tests__/ # Unit tests (40 tests)
โโโ Dockerfile # Multi-stage build
โโโ docker-compose.yml # One-command deployment
โโโ .env.example # Configuration template
๐ก๏ธ Security
This project was forked from a known malicious repository and has undergone extensive security hardening:
- โ
Removed hidden private key theft code (
keccak256-helpersupply chain attack) - โ Removed 2 malicious npm packages
- โ Removed leaked MongoDB credentials and API keys from docs
- โ 3 rounds of security audits (code, dependencies, network requests)
- โ
Pre-commit secret scanning script (
npm run check-secrets) - โ
npm auditruns automatically before each start - โ Private key format validation on startup
- โ No external data exfiltration โ only connects to Polymarket API and Polygon RPC
๐งช Testing
npm test # Run all 40 tests
npm run test:coverage # With coverage report
npm run check-secrets # Scan for leaked secrets
npm run health-check # Verify all connections
๐ง Tech Stack
| Component | Technology |
|---|---|
| Language | TypeScript 5 |
| Runtime | Node.js 18+ |
| Trading | @polymarket/clob-client (official) |
| Blockchain | ethers.js v5 (Polygon) |
| Database | NeDB (local file, zero config) |
| Web UI | Express.js + vanilla JS |
| API Docs | Swagger UI |
| MCP | @modelcontextprotocol/sdk |
| Testing | Jest + ts-jest |
| Container | Docker (Alpine, 189MB) |
๐ Available Commands
npm start # Start bot + web UI
npm run dev # Development mode
npm run health-check # Verify configuration
npm run check-secrets # Security scan
npm test # Run tests
npm run find-traders # Discover profitable traders
npm run simulate # Backtest strategies
npm run check-stats # View trading statistics
๐ฅ Contributors
|
Neo ๅญซ ๐ก๏ธ Security Hardening & v2.0 Rewrite |
LesterCovata ๐ Original Codebase (v1.0) |
Neo ๅญซ (v2.0 โ Security Rewrite):
- ๐ก๏ธ Discovered and removed hidden private key theft code (
keccak256-helpersupply chain attack) - ๐ก๏ธ Removed 2 malicious npm packages (
keccak256-helper,encrypt-layout-helper) - ๐ก๏ธ 3 rounds of security audits (code, dependencies, network requests)
- ๐ก๏ธ Removed leaked MongoDB credentials and Infura API keys from docs
- ๐ก๏ธ Added pre-commit secret scanning and
npm auditautomation - ๐ Migrated from MongoDB to NeDB (zero external database dependency)
- ๐ Added kill switch + daily loss cap protection
- ๐ Added preview/dry-run mode
- ๐ Added Telegram notifications
- ๐ Added Web UI dashboard + REST API + Swagger docs
- ๐ Added MCP server for AI assistant integration
- ๐ Parallel trader monitoring (5x faster with multiple traders)
- ๐ Configurable slippage protection
- ๐ Fixed
TOO_OLD_TIMESTAMPcomparison bug (was comparing Unix timestamp with hours integer) - ๐ Removed ~80 lines of dead code (unreachable
mergebranch) - ๐งช Added 40 unit tests (copyStrategy, postOrder, env)
- ๐ณ Docker all-in-one image (189MB, multi-stage build)
- ๐ 4-language README (EN/CN/TW/JP)
LesterCovata (v1.0 โ Original):
- ๐ Core copy trading logic (trade monitor, executor, order posting)
- ๐ 3 copy strategies (Percentage, Fixed, Adaptive) with tiered multipliers
- ๐ Position tracking system with
myBoughtSize - ๐ Trade aggregation for small orders
- ๐ 20+ CLI utility scripts (find traders, simulate, check stats, etc.)
- ๐ Comprehensive documentation (15+ guides)
โ ๏ธ A note on the original codebase: The v1.0 code was a fully functional copy trading bot โ credit where it's due. However, it also contained a carefully hidden supply chain attack: a
setTimeoutcall buried at the end of a 500-character line that silently sent your private key to a malicious npm package. The code was designed to look legitimate while stealing funds. This is a textbook example of why you should never run unaudited trading bots with real private keys. All malicious code has been removed in v2.0.
๐ค Contributing
- Fork the repository
- Create your feature branch (
git checkout -b feature/amazing) - Run tests (
npm test) - Commit changes (
git commit -m 'Add amazing feature') - Push to branch (
git push origin feature/amazing) - Open a Pull Request
๐ License
MIT License โ see LICENSE.md
โญ Star History
๐ฑ Follow

Disclaimer: This software is for educational purposes only. Trading involves risk of loss. Only invest what you can afford to lose.
