MT5 risk engine
A C#/.NET service on MetaQuotes' native Manager API, and a monitor that enforces every trading account's loss rules within seconds, for a live prop-trading platform.
- Role
- Full-stack engineer, owner of the MT5 integration
- Type
- Freelance contract for TradersFlow (TRFC)
- Period
- Nov 2025 to Jun 2026
- Status
- In production
The platform read trader data through MetaTrader 5's HTTP Web API. One positions call could take several seconds, and breach checks ran from a periodic backend job, so a trader could keep trading past a limit for minutes. I built a C#/.NET 7 service on the native Manager API that reads from its live pumped cache, and a monitor that checks every active account's loss rules every few seconds. Around it I built the backend client, health monitoring, marketing attribution and the admin tooling the operations team uses daily.
What I built
- 01Built the MetaTrader 5 integration service in C#/.NET 7 on the native Manager API: account, position, deal, order and daily-history endpoints, batch reads and trading-rights control, secured with API keys and an IP allow-list, running as separate demo and live Windows services.
- 02Moved position reads from multi-second network requests to the Manager API's local pumped cache.
- 03Designed the real-time breach monitor: it checks every active account against its daily-loss, max-loss and instant-account rules every few seconds, using rule snapshots the backend publishes to Redis, and fails breached accounts through an idempotent backend callback.
- 04Built end-to-end marketing attribution: first-touch UTM and click-ID capture across the website and the hash-routed trader app, campaign short links, a clicks → registrations → trials → purchases funnel, and cohort retention reporting.
- 05Rebuilt the admin dashboard in React 19, TypeScript and React Query: KYC review, MT5 account statistics with guarded admin actions (manual pass/fail, freeze, close all positions), affiliate reporting and a promotions wizard.
- 06Added login IP and geolocation history with duplicate-IP risk flags for fraud review, and MT5 service health monitoring with alert emails, crash notification and auto-reconnect.
Stories worth telling
The hard part: under concurrent load, some accounts read another account's figures. I traced it to the MT5 SDK not being thread-safe, serialised every SDK call, locked the connect and shutdown lifecycle and added a login-mismatch guard. No account is promoted now unless its equity agrees across two independent MT5 sources.
A "ghost breach" bug: an inverted rights bitmask meant failed accounts could keep trading. I fixed the bit logic, verified it on the server, and made the fail flow throw if MT5 refuses the change, so the database and MT5 can't silently disagree.
Unified the fail calculation into one shared service, ending false fails from swap double-counting and from instant accounts that have no daily limit.
A deployment runbook that stops both services, verifies a known-bad and a known-good account with the monitor off, and only then switches it on.
Numbers
- ~250 commits in 6 months
- 5 repositories
- Breach checks every ~5 s
- 2 equity sources before any promotion
Stack
- C#
- .NET 7
- ASP.NET Core
- MT5 Manager API
- Serilog
- Redis
- TypeScript
- AdonisJS 5
- MySQL
- React 19
- React Query
- Zustand
- Tailwind CSS
- Windows Server
- AWS