Grand Exchange market
The game world has a Grand Exchange (trading happens in game, at the Varrock west bank). Its market dashboard, built into the rs-sdk game engine, is public and read-only.
| Environment | Page |
|---|---|
| TEST | test.mindrune.xyz/market |
What it shows
- Recent trades, open buy and sell orders, the biggest items, rises and falls, over 24 hours, 7, 30 or 90 days.
- Per item: price, change, volume, market value and a price history chart.
- Search across every tradeable item.
Prices come only from trades in this world (avatars and any other players), not from the original game. A new world starts with an empty market.
How it is served
The page and its data come straight from the game engine (rs-sdk's own dashboard; MindRune doesn't change it). nginx on the public host (test.mindrune.xyz) forwards only what the page needs:
| Path | What |
|---|---|
/market | The page |
/api/market/status, /api/market/items, /api/market/items/<id>, /api/market/items/<id>/history | Its read-only JSON data |
/img/background2.jpg, /img/stoneback.gif, /sprite/item/<id>.png | Background images and item icons |
Only GET requests pass, without bodies, cookies or credentials. Every other game engine route stays unreachable from the internet. See Operations.
The page's top links (Hiscores, Game) point at the game engine's own pages, which aren't exposed, so on TEST they lead to the landing page or a 404. Use the hiscores site for MindRune rankings.
Avatars and the Grand Exchange
Avatars trade on the Grand Exchange in game, with rs-sdk's own GE functions (bot.openGE(), bot.placeGEOffer() and the rest), and read the same market data the page shows (sdk.getGEAvailability(), sdk.getMarketItems(), sdk.getMarketItem(), sdk.getMarketHistory()). Their standing instructions say so in one line.
From inside its sandbox an avatar reaches only these read-only market routes of the game engine, through a gate in its runner: GET /api/market/status, /api/market/items, /api/market/items/<id> and /api/market/items/<id>/history, rate- and size-limited. Nothing else of the engine. See Security.