Alpha Forge Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Alpha Forge Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server that exposes the AlphaForge `alpha-forge` CLI to AI coding agents — Claude Code, Cursor, Codex, and any MCP-capable client — over stdio.
⚠️ Pre-release / Alpha (`0.1.0aN`). Tool signatures and return formats may change without notice. Not recommended for production automation yet. Feedback welcome via Issues.
It is a thin open-source wrapper: it shells out to the (commercial, closed-source) alpha-forge binary with --json and returns the parsed result. The MCP server itself contains no core logic — alpha-forge plus a valid license are required for anything to actually run.
| Tool | What it does | Underlying command |
|---|---|---|
list_strategies | List registered strategies | alpha-forge strategy list --json |
get_strategy | Full JSON of one strategy | alpha-forge strategy show <id> --json |
list_results | List saved backtest results | alpha-forge backtest list [--strategy <id>] --json |
get_result | Metrics & trades of one result | alpha-forge backtest report <result_id> --json |
run_backtest | Run a backtest | alpha-forge backtest run <symbol> --strategy <id> [--start] [--end] --json |
run_optimize | Optimize parameters (Optuna) | alpha-forge optimize run <symbol> --strategy <id> [--metric] [--trials] --json |
generate_pinescript | Generate Pine Script v6 source | alpha-forge pine preview --strategy <id> [--with-webhook] |
All tools carry MCP tool annotations (readOnlyHint for the read tools; openWorldHint for run_backtest / run_optimize, which fetch external market data) and return structured output — structuredContent with an object outputSchema — alongside the text result.
Every tool returns a uniform error envelope as its (always-successful) result rather than raising, so an agent can branch on the failure category mechanically instead of parsing free text:
{"ok": true, "data": { ...alpha-forge JSON... }, "error": null}{"ok": false, "data": null, "error": {"code": "<category>", "message": "<human readable>", "detail": null}}error.code is the machine-readable failure category — e.g. forge_not_found (binary missing → guide setup), authentication_required (run alpha-forge system auth login), freemium_blocked (premium-only feature → stop), strategy_not_found, timeout (safe to retry), bad_output, execution_failed. The outputSchema reflects this ok / data / error shape.
Read-only data is also exposed as MCP resources, so clients such as Claude Code can reference them by @-mention without an explicit tool call. They delegate to the same alpha-forge commands as the read tools and return application/json.
| Resource URI | Payload |
|---|---|
forge://strategies | All registered strategies |
forge://strategy/{strategy_id} | One strategy definition |
forge://results | All saved backtest results |
forge://result/{result_id} | Metrics & trades of one result |
Reusable workflows are exposed as MCP prompts (surfaced as /mcp__alpha-forge__<name> slash commands in Claude Code):
| Prompt | Arguments | What it does |
|---|---|---|
backtest_and_review | strategy_id, symbol | Run a backtest, then review the key metrics and red flags |
optimize_and_verify | strategy_id, symbol | Optimize with Optuna, then check the result for overfitting |
Streamable HTTP transport, RBAC, rate limiting, and audit logging are planned for a later release.
PATH (or set ALPHA_FORGE_BIN).alpha-forge system auth login once.uvx).The recommended way is via uvx — no manual install needed; your IDE launches it on demand.
uvx alpha-forge-mcp # starts the stdio MCP serverOr install explicitly:
pip install alpha-forge-mcp
alpha-forge-mcpThe easiest way is the claude mcp add command (user scope — available in every project):
claude mcp add --scope user alpha-forge -- uvx alpha-forge-mcpAlternatively, add the server to a project-scoped .mcp.json at the repository root (checked in and shared with your team):
{
"mcpServers": {
"alpha-forge": { "command": "uvx", "args": ["alpha-forge-mcp"] }
}
}Note: Claude Code does not read~/.claude/mcp.json. User-scoped servers are stored in~/.claude.json(managed byclaude mcp add); project-scoped servers live in.mcp.jsonat the project root.
Use the same command / args in the client's MCP server configuration:
{
"mcpServers": {
"alpha-forge": { "command": "uvx", "args": ["alpha-forge-mcp"] }
}
}If alpha-forge is installed at a non-standard location, pass it via env:
{
"mcpServers": {
"alpha-forge": {
"command": "uvx",
"args": ["alpha-forge-mcp"],
"env": { "ALPHA_FORGE_BIN": "/path/to/alpha-forge" }
}
}
}alpha-forge (or legacy forge) is on PATH, or setALPHA_FORGE_BIN=/path/to/alpha-forge.
alpha-forge system auth login. The MCP server doesnot store credentials; it relies on alpha-forge's own auth.
uv sync --extra dev
uv run pytest
uv run ruff check .Forge binary discovery order: ALPHA_FORGE_BIN → PATH (forge, alpha-forge) → OS default install paths.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.