ricow

A fully local, multi-platform quantitative strategy engine for crypto — backtest, Dry Run, and live trading.

From idea, to rule, to live.

English · 中文

Pure local CLI. No cloud, no telemetry, no auto-update. Your keys and your data never leave your machine.

One binary — ricow, built from a 5-crate Rust workspace.
Strategies in Lua, sandboxed (no os/io/require/loadstring/pcall, 1M instructions per tick, 64 MB memory).
One config file: ricow.toml (plaintext, never committed; 0600 on Unix, current-user ACL on Windows).
Four run modes: backtest → Dry Run → demo (Binance testnet, real orders) → live (real money).

Install

# Linux / macOS
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/ailenwu2000/ricow/releases/latest/download/ricow-installer.sh | sh

# Windows (PowerShell)
powershell -ExecutionPolicy Bypass -c "irm https://github.com/ailenwu2000/ricow/releases/latest/download/ricow-installer.ps1 | iex"

Prefer a tarball? All platform archives (Linux x64/arm64, macOS x64/arm64, Windows x64) plus SHA256 checksums are on the Releases page. Build from source with cargo build --release.

Four run modes

Mode	Command	Capital	Prerequisites
Backtest	`ricow backtest --strategy linear_position_grid --pair ETHUSDT --days 30`	none	zero config
Dry Run (local virtual matching)	`ricow start <name>`	none	zero config
demo (Binance testnet, real orders)	`ricow start <name> --demo`	simulated	`[exchange].demo_*`
Live (mainnet, real money)	`live_enabled = true` + `ricow start <name> --live --accept-risk`	real	`[exchange].binance_*` + first-use risk acknowledgement + Dry Run duration gate

demo and live both call the real exchange API — they differ only in domain (demo-api/demo-fapi vs mainnet) and credentials, and the two credential sets never fall back to each other.

Writing your own strategy

Strategies are Lua scripts driven by a small engine API (ctx, exec.*). The guided path compiles and backtests before anything touches your disk:

ricow create --name my_strategy --pair ETHUSDT --script my_strategy.lua   # compile gate + real-K-line sandbox backtest
ricow approve                                                             # you type the confirmation in your terminal
ricow deploy <preview_id> --token <token>                                 # lands in strategies/

Built-in strategy: strategies/spot/linear_position_grid.lua (linear position grid) — read it as a starting point. Full API reference: specs/lua-api.md.

Safety model

Keys stay local. One ricow.toml on your machine (0600 on Unix / current-user ACL on Windows, git-ignored). The tool never writes keys for you and never sends them anywhere.
Live trading is gated. A strategy must declare live_enabled = true; the CLI requires --live --accept-risk, a first-use risk acknowledgement, and a minimum Dry Run duration before it will go live.
Write actions are human-only. Confirmation phrases (deploy / go live / risk ack / stop) are only accepted when typed by you: the assistant can register a pending action, but the phrase is checked against your keystrokes in the same interactive session — anything fed through pipes, scripts, or tool calls is rejected.
The assistant never gets write tools. It can answer questions, run backtests, and read the docs; deploying, starting, or stopping anything takes a pending action plus a phrase you type yourself.

Platform support

Platform	Status
Linux x86_64	Verified on a real machine (build, backtests, demo/testnet order flows)
Linux arm64	Built and published by CI; live/Dry Run flows not yet exercised on real hardware
Windows x86_64	Builds and the full unit-test suite pass in CI; live/Dry Run flows not yet exercised on real hardware
macOS (x86_64 / arm64)	Built and published by CI; not exercised on real hardware

A published artifact is not a support claim: platforms other than Linux x86_64 have not been run end-to-end against a real exchange yet.

Documentation

README (English)
build, config, run modes, network

README(中文)
构建 / 配置 / 四档运行 / 网络

Strategy API (Lua)
ctx / exec.* / 执行模式

Contributing
build, test discipline, PR flow

Bugs and questions: GitHub Issues. Security reports: please use SECURITY.md instead of a public issue.