Imported from zapier/connectors (apps/alpaca/SKILL.md). Install upstream with npx skills add zapier/connectors --skill alpaca. Copyright stays with the author (Elastic-2.0).

Alpaca

Tools for trading on Alpaca against the Trading API: place and manage stock, crypto, and options orders; read account balances, positions, portfolio history, and activities; look up assets, market hours, and option contracts; and read watchlists. 25 scripts across account, orders, positions, assets, options, and watchlists. Trades run against Alpaca's paper (simulated) environment by default; live real-money trading requires an explicit opt-in (see Auth). Money and quantity values are returned as strings to preserve decimal precision — never coerce them to numbers. Order placement is async-confirmed: placeOrder acknowledges receipt with a status that can change server-side, so re-query getOrder before asserting a fill.

Independent, unofficial connector for Alpaca. Not affiliated with, endorsed by, or sponsored by Alpaca. "Alpaca" is a trademark of its owner, used only to identify the service this connector works with.

When to use this

• Inspect the account — read balances and buying power, list open positions and unrealized P&L, review portfolio history and account activities (fills, dividends, fees), or check whether the market is open.
• Place and manage orders — buy or sell stocks, crypto, or options (market/limit/stop/bracket/OCO/OTO/multi-leg); replace or cancel open orders; close or liquidate positions; exercise an options position.
• Look things up — resolve a symbol's tradability/shortability/fractionability, list assets or option contracts, and read watchlists.

Setup

This is an agentskills.io skill.

If the connector has not been installed as a skill yet, install it first with npx skills add zapier/connectors --skill alpaca (or your harness's own skill-install mechanism), then continue here. Installing the skill copies these files, not dependencies. Before running the CLI, a local MCP server, or zapier-sdk auth commands, run npm install --omit=dev here once. Importing the published package as a dependency in your own project instead? That npm install already resolves everything — see references/use-as-sdk.md.

Want the actual repo source instead — to browse references/, run this connector's tests, or hack on it? See README.md for a scoped git clone.

The connector runs on Node.js 22.18+. Pick the reference that matches how you're running it, and load it before doing anything else:

Scripts

All scripts use the single connection alpaca. Trading tools hit the paper host by default (live requires an opt-in — see Auth).

Disambiguation & refusals

Disambiguation before a write. Trade and position tools key on an exact symbol or id, not a company name. Before acting on something the user named loosely:

• Symbols / assets — if the user gives a company name ("Apple") rather than a ticker, resolve it first with getAsset or listAssets. If exactly one asset matches, act on it; if several plausibly match, list them (symbol + name + exchange) and ask which. Never guess a ticker.
• Watchlists — resolve by name with getWatchlistByName or listWatchlists. Names are unique per account, so one exact (case-insensitive) match is the answer — act on it, don't over-ask. If nothing matches, say so. This connector reads watchlists but does not create or modify them (see Unsupported operations).
• Orders / positions — take an order_id or symbol the user already has (from listOrders / listPositions). If they describe an order vaguely ("cancel my Tesla order"), list the candidates first and confirm before canceling.

Unsupported operations — say so and stop; don't fake it with another tool. This connector deliberately does not:

• Move money — no deposits, withdrawals, transfers, bank links, or funding. Those live on Alpaca's Broker API and are out of scope.
• Read market data — quotes, bars, snapshots, news, corporate actions, and option chains are out of scope. This connector wraps Alpaca's Trading API only, not the Market Data API (data.alpaca.markets); there are no price/history or streaming tools.
• Create or modify watchlists, or change account configuration — this connector reads watchlists (listWatchlists / getWatchlist / getWatchlistByName) and account settings (getAccountConfigurations) but does not create, update, or delete them.
• Trade against a live account by default — trading is paper (simulated) unless the user has explicitly enabled live (see Auth). If asked to trade real money, confirm live is enabled rather than assuming.
• Manage the stock screener, OAuth apps, or account documents — not exposed.

If asked for any of these, tell the user it's unsupported and stop — don't substitute an unrelated tool and report success for an action you didn't perform.

Auth

Every shape passes auth as one connection selector, not the secret — a [<resolver>:]<value> string. Every connector accepts zapier:<connection-id> (Zapier-managed auth — routes through Zapier's auth, retries, and governance layer); some also accept one or more direct-token resolvers (naming and count vary per connector) — check this connector's own resolvers rather than assuming. The <resolver>: prefix is optional; a bare value goes to the first resolver that claims it — a UUID-shaped bare value always claims zapier:. Each script declares the connections it needs and the resolvers each accepts. The exact syntax for passing a connection (and how to see this connector's resolver list) differs by shape — see the reference you loaded above.

Checking what's already configured first? Don't dump environment values to do it — env or env | grep <name> prints the value along with the name, leaking a live credential into the transcript if one is set. Check names only (env | cut -d= -f1 | grep -i <name>) or test a known name directly ([ -n "$VAR_NAME" ]).

Zapier-managed auth (zapier:<connection-id>) is experimental for Alpaca — the direct resolver (alpaca:<PREFIX>) is the verified path.

No connection yet? Pick one — and follow the reference's own flow to obtain it; never just ask the user for a connection id or token as if they already have one memorized:

Output format

Every script returns a { data, meta } envelope:

• data — the script's result (the shape its outputSchema declares; see the reference you loaded above for how to inspect a script's exact schema in your shape).
• meta.outputDataValidation — what validating data did:
  • { skipped: false, droppedPaths: null } — validated, nothing removed.
  • { skipped: false, droppedPaths: [...], instruction } — validated, but those paths were stripped from data: fields the script returned from the API that the outputSchema doesn't declare. If you need them, re-run with output validation skipped.
  • { skipped: true } — validation was bypassed; data is the raw, unchecked script output.

Reading dropped fields / skipOutputDataValidation. To receive the raw, unvalidated result, opt out of output validation (the exact syntax differs by shape — see the reference you loaded above). Input validation is never skipped.

Trimming the result / filterOutputData. To shrink a large result down to the fields you need, pass a jq expression that post-processes data (again, exact syntax per shape). The jq runs against data only, NOT the { data, meta } envelope, so write it rooted at data (run the script's --help — or your shape's equivalent — to see its output schema). The transformed value replaces data, meta is preserved, and the result is NOT re-validated against the output schema.

References

Load the matching reference file before working in that area: