Build on Percolator

Permissionless perpetual markets. This page covers how to read markets, connect an agent, and where each part of the stack lives.

Clawd Chain is a test network. CLAWD and cUSD there have no real-world value. The programs are unaudited. Solana mainnet is not live: see the mainnet plan.

Where things are

Site	What it is
Terminal	Launch a market, trade it, stake its insurance fund.
Market	The CLAWD market registry.
Risk Engine	A simulated terminal for probing the risk engine.
Install	Install Percolator.
Mobile	Percolator on mobile.
Hedge Fund	Percolator Hedge Fund.
Dark	The Dark Percolator explainer. Reference: Dark Percolator and Dark Payments below.

Read markets over HTTP

Route	Returns
`GET /api/markets`	Every market in the Clawd Chain registry, with its market and perp accounts.
`GET /api/board`	Those markets beside the live Phoenix perps price for the same asset, plus the upstream Percolator market on Solana mainnet. Every row names its network; test markets are never given a mainnet price.
`GET /api/clawd-markets`	The CLAWD market registry.
`GET /api/pyth/feeds`	The Pyth Pro feeds this site is entitled to (21 spot, FX, metal and equity symbols, plus the WTI futures chain). The API key stays on the server.
`GET /api/pyth/history`	Official Pyth Pro OHLC history for an allowlisted symbol on the `fixed_rate@1000ms` channel. Query: `symbol`, `from`, `to` (Unix seconds, inclusive), `resolution` (minutes, or `D`/`1D`, `W`/`1W`, `M`/`1M`).
`GET /api/status`	Whether each dependency is up, with response times. Shown on the status page.
`GET /api/health`	Service health.

curl -s https://percolator.tech/api/board

curl -s 'https://percolator.tech/api/pyth/history?symbol=Crypto.BTC%2FUSD&from=1781079582&to=1783671582&resolution=1D'

Connect an agent (MCP)

The MCP server speaks Streamable HTTP at /mcp. A live feed is on the WebSocket at /ws. Market reads are free.

curl -s https://percolator.tech/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"curl","version":"0"}}}'

Tool	Arguments	What it does
`percolator_list_markets`	`cluster`, `limit`	Lists markets on a cluster.
`percolator_read_market`	`slab`, `cluster`	Decodes one market: config, oracle state, engine totals.
`percolator_oracle_price`	`slab`, `cluster`	The market's current index price.
`percolator_quote`	`slab`, `size`	Quotes a position. Size is in base units: positive long, negative short.
`percolator_detect_venue`	`mint`, `cluster`	Finds the pool for a token and whether a perp market can be opened on it.

The server never signs. Where write tools are enabled they return an unsigned transaction for your own wallet.

How the mainnet reference market is priced

The upstream Percolator Bounty4 market (STOXX 50 ETF / SOL, 20×, wSOL collateral) shown read-only on the terminal uses three Pyth feeds. It is not a market of this site and cannot be traded here. Full write-up: PERCOLATOR.md.

STOXX50_EUR x EUR_USD / SOL_USD  ->  invert  ->  mark

While all three feeds are fresh, that composite is the mark. European equities close; when a feed is older than the market's staleness limit, the mark falls back to a stored moving average (EWMA), and a trade then pays the base fee plus the amount it moves that average. Moving the mark by X costs at least X, so it cannot pay.

Dark Percolator

Design and source only. The program is unaudited and not deployed, its program id is a placeholder, and nothing on this site signs or sends a transaction for it.

Percolator-style perps where the market is public and the trader is not. The market account (mark, EWMA, fee mode, aggregate open interest, pool, insurance) stays readable by anyone, so solvency stays auditable. Each trader's size, side, entry, collateral and liquidation price live in a MagicBlock Private Ephemeral Rollup on Intel TDX, readable only by the trader, the market keeper and up to two auditors the trader names. Collateral is native SOL.

Step	Layer	What happens
1	Base	`init_market` creates the market, a vault and a hedge ticket. `fund` seeds insurance or pool collateral.
2	Base	The trader calls `open_portfolio` and `deposit`, then `delegate_portfolio` to the market's TEE validator.
3	Rollup	`init_permission`, then `set_privacy`. Members: trader (logs, message, balances), keeper (logs, balances), auditors (balances).
4	Rollup	The oracle calls `push_mark`. Fresh means all three Pyth legs are inside 600 s. When stale, the EWMA becomes the mark and the fee charges for its drift.
5	Rollup	The trader calls `submit_intent`. It is refused unless the portfolio's permission is private. The program stores the intent and its SHA-256 commitment.
6	Rollup	The keeper calls `cross_batch` with up to 16 portfolios. Intents fill at the mark; buys cross sells; the pool absorbs the imbalance up to `pool_cap`; the heavy side fills pro rata.
7	Rollup	`liquidate` closes an account under maintenance at the mark. Fees go to insurance, which absorbs bad debt first.
8	Rollup to base	`commit_market` commits the market and writes the pool's inventory to the hedge ticket. An operator places the offsetting Phoenix order from their own wallet.
9	Rollup to base	`undelegate_portfolio`, then `withdraw` once the portfolio is flat with no open intent.

Data	Who can see it
Mark, EWMA, fee mode, parameters	Everyone
Aggregate open interest, pool inventory, insurance, fees	Everyone, published on commit
Per-trader size, side, entry, collateral, PnL, liquidation price	Trader, keeper, named auditors
Intents before the batch	Keeper and that trader
The Phoenix hedge	Everyone: it is the pool's net on a public book

Known gaps: the mark is pushed by a trusted oracle key, not read from Pyth; one keeper key runs batches, liquidations and commits, so a stalled keeper stalls the market; insurance and pool funds have no withdraw path yet; the permission flow has not been run against a live rollup. Privacy rests on Intel TDX and on MagicBlock operating the validator.

Dark Payments

Mostly design. The read client for the Helius Privacy Rings API exists; deposits, transfers, withdrawals, Dark x402, shielded swaps and shielded messaging are not built.

Value and state move on Solana without publishing the link between who paid, who traded and how much, while settlement, solvency and aggregate flow stay publicly verifiable.

Name	What it is
Shielded tx	A transfer inside a Solana Privacy Ring: deposit, shielded transfer, withdraw, with amounts and counterparties encrypted on-chain.
Shielded swaps	An exchange whose funding and proceeds legs are shielded. In the first version the swap leg itself is a public trade from a fresh wallet.
Shielded messaging	Agent messages whose payment proposals settle as shielded transfers.
Dark x402	A machine payment where the payer pays shielded and the facilitator verifies settlement from shielded-transaction reads instead of a public transaction link.
Dark Perps	The trader-facing private-perps product. Dark Percolator is its engine.

What a ring hides, and what it does not:

Data	Visible to
That a wallet deposited or withdrew, when, and the amount at that boundary	Everyone
Transfer amounts and the sender-recipient link inside the ring	The parties, through viewing keys
Private balance	Owner only, computed locally
Registry record (owner, shielded address, viewing public key)	Everyone: it is an address book, not a balance

What this does not claim: no hidden orders on a public order book; ring deposits and withdrawals are public events, so timing and amount correlation is an operational risk; the x402 facilitator still learns what it must to settle; read privacy trusts Helius with query patterns.

Programs on Clawd Chain

Program	Address
Wrapper	`6Grr3eyuJVME5gDbeT6g6Q3pojQGSuSDaEmHDM7QYhzx`
Insurance stake	`85rgQvJsqVq5gF9TPMtxmPQaoVMGK1wd6qx1FZqfXk5q`
Position NFT	`GDaUkuhbErfBuL92oV93bWWHEVn9NF7pRNikSeq6nHLR`

RPC https://rpc.clawdchain.trade · Explorer · Faucet. Read /api/markets for current market accounts instead of hard-coding them.

Privacy · Terms · Support