PipSync Examples

Runnable, dependency-free examples for building against PipSync-shaped contracts without connecting a broker or sending a live order.

Every server binds to loopback, every fixture is synthetic, and every signal uses paper or sandbox mode. The repository contains no production keys, write-capable MCP tools, broker adapters, or live execution path.

These examples are educational integration code, not trading signals, investment advice, or a promise of performance. Trading can result in loss.

Included examples

Example	What it demonstrates	Safety boundary
TradingView	Pine Script v6 alert conditions and UI payload templates	mode=paper; no URL or key embedded
Custom webhook	Bounded JSON parsing, validation, and duplicate receipt handling	loopback; in-memory receipts; no downstream calls
Signed webhook	Exact raw-body HMAC verification and timestamp-freshness checks	secret from environment; auth before parsing
Read-only API/SSE	GET /me, GET /signals, and a local bounded SSE stream	synthetic local API; every write method returns 405
Read-only MCP	Stateless MCP 2026-07-28 stdio mock with two read tools	synthetic data; write tools do not exist

Requirements

• Python 3.11 or newer
• curl only for the optional shell walkthroughs
• no third-party Python packages

Clone the repository and run the tests:

PYTHONPATH=src python -m unittest discover -s tests -v

Then start the local custom webhook receiver:

python examples/custom_webhook/receiver.py
curl --fail-with-body \
  -H 'Content-Type: application/json' \
  --data-binary @fixtures/paper-custom-signal.json \
  http://127.0.0.1:8787/webhooks/custom

The response includes "execution":"disabled". See each example directory for its complete walkthrough.

Contract notes

The schemas in this repository are intentionally a small example subset, not a replacement for PipSync's versioned public OpenAPI/JSON Schema contract. Keep payloads versioned and treat a deployed API specification as authoritative.

Signed webhook verification follows this sequence:

1. Read the exact raw request bytes once.
2. Parse exactly one t and one or more v1 fields for key rotation.
3. Reject timestamps outside the configured freshness window.
4. Compute HMAC-SHA256 over <timestamp>.<raw-body>.
5. Compare digests in constant time.
6. Only then parse JSON and create a receipt.

The in-memory duplicate set is suitable only for a local demonstration. A production receiver needs a durable, tenant-scoped idempotency key and an atomic uniqueness constraint before any side effect.

Using a remote read-only endpoint

The API client defaults to http://127.0.0.1:8788. Remote account and signal reads require an explicit --allow-remote flag and HTTPS. Keys can be loaded only by naming an environment variable, and returned JSON passes through secret redaction. --base-url is the API origin (for example https://app.pipsync.io); the client appends the documented /api/v1 paths. SSE remains a credential-free loopback-only mock because the public API specification does not publish that route.

Project status

This is an initial 0.1.0 source release. It is intentionally distributed as a GitHub repository, not as a pipsync-examples PyPI package: clone it so the runnable scripts, fixtures, and guides remain together. See CHANGELOG.md. Security reports should follow SECURITY.md; contributions should follow CONTRIBUTING.md.

Continue with PipSync

Keep these examples in paper mode while you learn the boundary. To connect a supported signal source through the managed service, choose the matching guide in the PipSync integration directory.

License

Apache License 2.0. See LICENSE and NOTICE.