Alphavantage — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Alphavantage (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A MCP server for the stock market data API, Alphavantage API.
<a href="https://glama.ai/mcp/servers/@calvernaz/alphavantage"> <img width="380" height="200" src="https://glama.ai/mcp/servers/@calvernaz/alphavantage/badge" alt="Alpha Vantage Server MCP server" /> </a>
MCP Server URL: https://mcp.alphavantage.co
PyPi: https://pypi.org/project/alphavantage-mcp/
ALPHAVANTAGE_API_KEYThe easiest way to use the AlphaVantage MCP server is with uvx:
# Run directly without installation
uvx alphavantage-mcp
# Or with specific arguments
uvx alphavantage-mcp --server http --port 8080pip install alphavantage-mcp
alphavantage-mcpgit clone https://github.com/calvernaz/alphavantage.git
cd alphavantage
uv run alphavantageThe AlphaVantage server can run in two different modes:
This is the standard MCP server mode used for tools like Claude Desktop.
alphavantage
# or explicitly:
alphavantage --server stdioThis mode provides real-time updates via HTTP streaming.
alphavantage --server http --port 8080This mode adds OAuth 2.1 authentication to the HTTP server, following the MCP specification for secure access.
alphavantage --server http --port 8080 --oauth#### OAuth Configuration
When using the --oauth flag, the server requires OAuth 2.1 configuration via environment variables:
Required Environment Variables:
export OAUTH_AUTHORIZATION_SERVER_URL="https://your-auth-server.com/realms/your-realm"
export OAUTH_RESOURCE_SERVER_URI="https://your-mcp-server.com"Optional Environment Variables:
# Token validation method (default: jwt)
export OAUTH_TOKEN_VALIDATION_METHOD="jwt" # or "introspection"
# For JWT validation
export OAUTH_JWT_PUBLIC_KEY="-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----"
export OAUTH_JWT_ALGORITHM="RS256" # default
# For token introspection validation
export OAUTH_INTROSPECTION_ENDPOINT="https://your-auth-server.com/realms/your-realm/protocol/openid-connect/token/introspect"
export OAUTH_INTROSPECTION_CLIENT_ID="your-client-id"
export OAUTH_INTROSPECTION_CLIENT_SECRET="your-client-secret"
# Optional: Required scopes (space-separated)
export OAUTH_REQUIRED_SCOPES="mcp:access mcp:read"
# Optional: Enable session binding for additional security (default: true)
export OAUTH_SESSION_BINDING_ENABLED="true"#### OAuth Features
The OAuth implementation provides:
/.well-known/oauth-protected-resource)#### Example: Keycloak Configuration
For testing with Keycloak:
# Keycloak OAuth configuration
export OAUTH_AUTHORIZATION_SERVER_URL="https://keycloak.example.com/realms/mcp-realm"
export OAUTH_RESOURCE_SERVER_URI="https://mcp.example.com"
export OAUTH_TOKEN_VALIDATION_METHOD="introspection"
export OAUTH_INTROSPECTION_ENDPOINT="https://keycloak.example.com/realms/mcp-realm/protocol/openid-connect/token/introspect"
export OAUTH_INTROSPECTION_CLIENT_ID="mcp-server"
export OAUTH_INTROSPECTION_CLIENT_SECRET="your-keycloak-client-secret"
export OAUTH_REQUIRED_SCOPES="mcp:access"
# Start server with OAuth
alphavantage --server http --port 8080 --oauth#### OAuth Client Flow
When OAuth is enabled, MCP clients must:
GET /.well-known/oauth-protected-resourceAuthorization: Bearer <access-token>Options:
--server: Choose between stdio (default) or http server mode--port: Specify the port for the Streamable HTTP server (default: 8080)--oauth: Enable OAuth 2.1 authentication (requires --server http)The AlphaVantage MCP server includes optional Prometheus metrics for monitoring and observability.
Set the following environment variables to enable telemetry:
# Enable telemetry (default: true)
export MCP_TELEMETRY_ENABLED=true
# Server identification (optional)
export MCP_SERVER_NAME=alphavantage
export MCP_SERVER_VERSION=1.0.0
# Metrics server port (default: 9464)
export MCP_METRICS_PORT=9464When telemetry is enabled, Prometheus metrics are available at:
http://localhost:9464/metricsThe server collects the following metrics for each tool call:
# Start server with telemetry enabled
export MCP_TELEMETRY_ENABLED=true
export MCP_SERVER_NAME=alphavantage-prod
export ALPHAVANTAGE_API_KEY=your_api_key
alphavantage --server http --port 8080
# View metrics
curl http://localhost:9464/metricsDeploy the AlphaVantage MCP Server on AWS Lambda using the stateless MCP pattern for production-ready, scalable deployment.
cd deploy/aws-stateless-mcp-lambda
export ALPHAVANTAGE_API_KEY=your_api_key_here
./deploy.shFeatures:
📖 Full Documentation: See AWS Deployment Guide for complete setup instructions, testing, monitoring, and troubleshooting.
#### Option 1: Using uvx (Recommended) Add this to your claude_desktop_config.json:
{
"mcpServers": {
"alphavantage": {
"command": "uvx",
"args": ["alphavantage-mcp"],
"env": {
"ALPHAVANTAGE_API_KEY": "YOUR_API_KEY_HERE"
}
}
}
}#### Option 2: From source If you cloned the repository, use this configuration:
{
"mcpServers": {
"alphavantage": {
"command": "uv",
"args": [
"--directory",
"<DIRECTORY-OF-CLONED-PROJECT>/alphavantage",
"run",
"alphavantage"
],
"env": {
"ALPHAVANTAGE_API_KEY": "YOUR_API_KEY_HERE"
}
}
}
}#### Running the Server in Streamable HTTP Mode
Using uvx:
{
"mcpServers": {
"alphavantage": {
"command": "uvx",
"args": ["alphavantage-mcp", "--server", "http", "--port", "8080"],
"env": {
"ALPHAVANTAGE_API_KEY": "YOUR_API_KEY_HERE"
}
}
}
}From source:
{
"mcpServers": {
"alphavantage": {
"command": "uv",
"args": [
"--directory",
"<DIRECTORY-OF-CLONED-PROJECT>/alphavantage",
"run",
"alphavantage",
"--server",
"http",
"--port",
"8080"
],
"env": {
"ALPHAVANTAGE_API_KEY": "YOUR_API_KEY_HERE"
}
}
}
}Watch a quick demonstration of the Alpha Vantage MCP Server in action:
This project includes scripts for publishing to PyPI and TestPyPI:
# Publish to TestPyPI (for testing)
python scripts/publish.py --test
# Publish to PyPI (production)
python scripts/publish.py
# Use uv publish instead of twine
python scripts/publish.py --test --use-uvThe script uses twine by default (recommended) but can also use uv publish with the --use-uv flag.
The repository includes a GitHub Actions workflow for automated publishing:
To set up publishing:
PYPI_API_TOKEN and TEST_PYPI_API_TOKEN secrets to your repositoryWe welcome contributions from the community! To get started, check out our contribution guide for setup instructions, development tips, and guidelines.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.