tinkle-community 99361cb085 fix(security): harden auth flows and lock down telegram bot tool
- config: require JWT_SECRET >=32 bytes and reject the historical
  default fallback; MustInit aborts startup under an insecure config
- api: CORS now uses CORS_ALLOWED_ORIGINS allowlist with safe
  localhost defaults instead of returning Access-Control-Allow-Origin: *
- api: /api/reset-password and /api/reset-account stay public so
  recovery still works, but require an explicit confirm phrase in the
  body to block accidental and drive-by triggers
- api: drop adoptOrphanRecords so wiping the account no longer hands
  the next registrant the previous owner's wallet keys and exchange
  API credentials
- api: getTraderFromQuery now does a soft ownership check; equity-history
  is restricted to traders with show_in_competition=true and
  GetOrderFills joins on trader_id
- telegram: bot api_request tool uses a default-deny method+path
  allowlist so prompt injection cannot reach password, exchange key,
  AI provider or wallet endpoints
- ci: drop @master / @main on trivy-action and trufflehog; pin to
  released versions with a TODO to move to SHA + Dependabot
- web: reset flows send the required confirm phrase; "Forgot account"
  copy (en/zh/id) warns that wallet and exchange keys will be lost
- docker-compose: keep ./.env mount for onboarding wallet persistence
  with an inline note on the tradeoff, drop the host-exposed pprof port
2026-05-29 07:51:26 +08:00
2026-04-18 16:06:42 +08:00
2026-04-27 10:51:09 +08:00
2025-12-21 01:36:16 +08:00
2025-12-21 01:36:16 +08:00
2025-11-25 20:32:01 +08:00
2025-12-21 01:36:16 +08:00
2025-11-25 20:18:29 +08:00
2025-12-21 01:36:16 +08:00

Backed by vergex.trade

NOFX

AI trading terminal for global markets.
Research, strategy generation, execution, and monitoring for US stocks, commodities, forex, and crypto.

Stars Release License Telegram

Go React

English · 中文 · 日本語 · 한국어 · Русский · Українська · Tiếng Việt


NOFX is an open-source AI trading terminal for active traders who want one workspace for market research, strategy development, execution, and portfolio monitoring.

The product is built around global liquid markets: US equities, commodity contracts, FX pairs, and digital assets. The AI layer helps translate market intent into watchlists, signals, strategy logic, risk controls, and execution workflows.

curl -fsSL https://raw.githubusercontent.com/NoFxAiOS/nofx/main/install.sh | bash

Open http://127.0.0.1:3000.


Register exchanges

Use the links below to open trading accounts for crypto and supported US stock, FX, and commodity derivative markets. These routes are part of NOFX partner programs and may include fee discounts or referral benefits.

Exchange Status Register with fee discount
Binance Register
Bybit Register
OKX Register
Hyperliquid Register
Bitget Register
KuCoin Register
Gate Register
Aster Register
Lighter Register

Quick demo

NOFX quick demo video

Click the cover image to watch the demo video.


Markets

US Stocks · Commodities · Forex · Crypto

NOFX organizes research, strategy construction, execution, and monitoring around multi-asset workflows instead of single-venue screens.


AI model access

NOFX routes AI inference through Claw402 automatically. Users do not need to configure model providers, manage API keys, or maintain separate AI accounts. The terminal accesses supported models on demand through Claw402's pay-as-you-go infrastructure, with traffic routed through the official discounted channel.

Provider Access
Claw402 Access pay-as-you-go AI models with official discount

Capabilities

Capability Description
AI trading terminal Unified workspace for US stocks, commodities, forex, and crypto workflows
AI model access Unified model access through Claw402-supported providers
Exchange connectivity Binance, Bybit, OKX, Hyperliquid, Bitget, KuCoin, Gate, Aster, and Lighter
Strategy Studio Market universes, indicators, risk controls, and strategy logic
Model competition Compare model-driven traders with live performance and leaderboard tracking
Telegram agent Control and monitor the trading assistant through chat
Portfolio dashboard Positions, P/L, execution history, and model decision logs

Screenshots

Config Page
Configuration Traders List
Dashboard
Overview Market Chart
Trading Stats Position History
Positions Trader Details
Strategy Studio
Strategy Editor Indicators Config
Competition
Competition Mode

Install

Linux / macOS

curl -fsSL https://raw.githubusercontent.com/NoFxAiOS/nofx/main/install.sh | bash

Railway (Cloud)

Deploy on Railway

Docker

curl -O https://raw.githubusercontent.com/NoFxAiOS/nofx/main/docker-compose.prod.yml
docker compose -f docker-compose.prod.yml up -d

Windows

Install Docker Desktop, then:

curl -o docker-compose.prod.yml https://raw.githubusercontent.com/NoFxAiOS/nofx/main/docker-compose.prod.yml
docker compose -f docker-compose.prod.yml up -d

From Source

# Prerequisites: Go 1.21+, Node.js 18+, TA-Lib
# macOS: brew install ta-lib
# Ubuntu: sudo apt-get install libta-lib0-dev

git clone https://github.com/NoFxAiOS/nofx.git && cd nofx
go build -o nofx && ./nofx          # backend
cd web && npm install && npm run dev  # frontend (new terminal)

Update

curl -fsSL https://raw.githubusercontent.com/NoFxAiOS/nofx/main/install.sh | bash

Setup

Beginner mode: Guided onboarding walks new users through model selection, exchange connection, strategy setup, and first deployment.

Advanced mode:

  1. Configure AI model access
  2. Connect exchange credentials
  3. Build or import a strategy
  4. Create an AI trader profile
  5. Launch, monitor, and iterate from the dashboard

All configuration is available from the web UI at http://127.0.0.1:3000.


Deploy to server

HTTP deployment:

curl -fsSL https://raw.githubusercontent.com/NoFxAiOS/nofx/main/install.sh | bash
# Access via http://YOUR_IP:3000

HTTPS via Cloudflare:

  1. Add domain to Cloudflare (free plan)
  2. A record → your server IP (Proxied)
  3. SSL/TLS → Flexible
  4. Set TRANSPORT_ENCRYPTION=true in .env

Architecture

                              NOFX
    ┌─────────────────────────────────────────────────┐
    │                 Trading Terminal                 │
    │        React + TypeScript + TradingView          │
    │      US Stocks · Commodities · Forex · Crypto    │
    ├─────────────────────────────────────────────────┤
    │                  API Server (Go)                  │
    ├──────────────┬──────────────┬───────────────────┤
    │   Strategy    │   Telegram   │   Trader Runtime  │
    │    Engine     │    Agent     │   Risk Controls   │
    ├──────────────┴──────────────┴───────────────────┤
    │                 AI Model Layer                    │
    │    Unified provider access through Claw402        │
    │    Model routing · payment · execution support    │
    ├─────────────────────────────────────────────────┤
    │              Exchange Connectivity                │
    │ Binance · Bybit · OKX · Hyperliquid · Bitget     │
    │ KuCoin · Gate · Aster · Lighter                  │
    └─────────────────────────────────────────────────┘

Docs

Architecture System design and module index
Strategy Module Coin selection, AI prompts, execution
FAQ Common questions
Getting Started Deployment guide

Contributing

See Contributing Guide, Code of Conduct, and Security Policy.

Contributor Airdrop Program

NOFX tracks meaningful contributions and intends to reward contributors as the ecosystem grows. Priority issues carry higher reward weight.

Contribution Weight
Pinned Issue PRs ★★★★★★
Code (Merged PRs) ★★★★★
Bug Fixes ★★★★
Feature Ideas ★★★
Bug Reports ★★
Documentation ★★

Website vergex.trade
Dashboard vergex.trade/explore
Telegram nofx_dev_community
Twitter @vergex_ai

Risk warning: Automated trading involves substantial risk. Use appropriate position sizing, understand each exchange venue, and do not trade funds you cannot afford to lose.


Sponsors

Become a sponsor

License

AGPL-3.0

Star History Chart

Description
Open-source Trading OS with pluggable AI brain | From market data → AI reasoning → Trade execution | Self-hosted & Multi-exchange
Readme AGPL-3.0 644 MiB
Languages
Go 67.9%
TypeScript 30.9%
Shell 0.6%
CSS 0.4%
JavaScript 0.1%