.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/finnhub-mcp-server</h1> <p><b>Real-time US-equity quotes, company fundamentals, earnings, analyst trends, and financial news via Finnhub. STDIO or Streamable HTTP.</b> <div>6 Tools • 1 Resource</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
Six tools, name-first: finnhub_search_symbols resolves a company name to a US ticker, then the other five work from that symbol — a live quote, full company context, earnings, news, and analyst consensus.
| Tool | Description |
|---|---|
finnhub_search_symbols | Resolve a company name or partial ticker to US stock symbols, best US match first. The entry point for every other tool. |
finnhub_get_quote | Real-time price quote for one US symbol, paired with live market-status so the response states whether the price is live or the prior close. |
finnhub_get_company | Full company context in one call — profile, headline fundamentals (P/E, EPS, margins, growth), and sector peers. |
finnhub_get_earnings | Earnings in two modes: a symbol's past quarters with actual-vs-estimate surprises (history), or market-wide upcoming releases in a date window (calendar). |
finnhub_get_news | Financial news in two modes: recent articles for one symbol over a date range (company), or broad market headlines by category (market). |
finnhub_get_recommendations | Analyst recommendation trends for one US symbol — strong-buy / buy / hold / sell / strong-sell counts per month, newest first. |
finnhub_search_symbolsResolve a company name, partial name, or ticker fragment to Finnhub stock symbols. Run this first when you have a name, not a ticker — the rest of the surface needs a symbol.
isLikelyUS (a dot-suffix heuristic — .SS, .T, .L are international) so an agent can avoid spending a call on a symbol the free tier can't reachlimit (1–50, default 10); reports the total match count and discloses truncation when more matched than returnedfinnhub_get_quoteReal-time price quote for one US symbol. The market-hours flag is the point — the response never presents a stale price as live.
/quote with /stock/market-status (parallel fan-out) to derive priceIsLive — true only when the US market is open; when closed, current is the prior close, surfaced as suchmarketOpen: null rather than tanking the quotesymbol_not_found; international or paid-only symbol → not_us_or_paidfinnhub_get_companyFull company context for one US symbol in a single call — profile is hollow without the valuation numbers, so this is deliberately one tool over three.
/stock/peers (includes the queried symbol)partial list, profile drives the not-found / forbidden errorsfinnhub_get_earningsEarnings data for one symbol or across the market, selected by mode.
history (requires symbol): past quarters — actual vs. estimate EPS, absolute surprise, and surprise % (the market-moving signal), newest firstcalendar (uses from / to, defaults to today through +14 days): upcoming releases across the market — date, EPS/revenue estimates, expected report timelimit (1–100, default 50); reports total rows and discloses truncationfinnhub_get_newsFinancial news for one company or the broad market, selected by mode.
company (requires symbol): recent articles over a date range (defaults to the last 7 days) — headline, source, ISO 8601 datetime, summary, URLmarket (uses category): broad headlines by general, forex, crypto, or merger (see the finnhub://news-categories resource)limit (1–50, default 15 — news lists run long); articles newest first, with total and truncation disclosurefinnhub_get_recommendationsAnalyst recommendation consensus for one US symbol — the view to pair with the live quote and fundamentals.
limit (1–24, default 12 — one year); reports total months and discloses truncationno_coverage, distinct from an invalid symbol| Type | Name | Description |
|---|---|---|
| Resource | finnhub://news-categories | The four valid market-news categories (general, forex, crypto, merger) with one-line descriptions. |
The resource is a convenience mirror — its data is fully covered by the category enum on finnhub_get_news, so tool-only clients lose nothing. Live data (quotes, news, earnings) is intentionally not exposed as a resource: it's time-sensitive, and the value is in the freshness, so it's reachable only through the tools.
Built on @cyanheads/mcp-ts-core:
none, jwt, oauthin-memory, filesystem, Supabase, Cloudflare KV/R2/D1Finnhub-specific:
not_us_or_paid domain error, 401 → loud configuration failure at first call (not "no data"), 429/5xx → retriedfinnhub_get_company fans out profile + metrics + peers in parallel and degrades to partial results when a leg failsAgent-friendly output:
symbol_not_found (unknown US ticker, detected from the all-zero quote / empty profile sentinel) vs. not_us_or_paid (international or paid-only, HTTP 403) — so an agent can tell them apart and recoverisLikelyUS on search results so an agent avoids burning a call on an unreachable symbolThis server requires a free Finnhub API key (Dashboard → API key). The free tier covers US equities in real time at 60 req/min.
Each user must obtain their own API key. Use is subject to Finnhub's Terms of Service — the free tier is for personal use only, and redistributing or sharing access to Finnhub data with third parties requires written approval from Finnhub.
Add the following to your MCP client configuration file.
{
"mcpServers": {
"finnhub-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/finnhub-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info",
"FINNHUB_API_KEY": "your-api-key"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"finnhub-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/finnhub-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info",
"FINNHUB_API_KEY": "your-api-key"
}
}
}
}Or with Docker:
{
"mcpServers": {
"finnhub-mcp-server": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"-e", "FINNHUB_API_KEY=your-api-key",
"ghcr.io/cyanheads/finnhub-mcp-server:latest"
]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 FINNHUB_API_KEY=... bun run start:http
# Server listens at http://localhost:3010/mcp.TO or .DE) and candle/forex endpoints are paid-tier and return a clear error.git clone https://github.com/cyanheads/finnhub-mcp-server.gitcd finnhub-mcp-serverbun installcp .env.example .env
# edit .env and set FINNHUB_API_KEYAll configuration is validated at startup via Zod schemas in src/config/server-config.ts. Key environment variables:
| Variable | Description | Default |
|---|---|---|
FINNHUB_API_KEY | Required. Free Finnhub API key from finnhub.io/register. Sent as the token query param; the server fails to start without it. | — |
FINNHUB_BASE_URL | Finnhub REST API base URL. Override for local testing or a proxy. | https://finnhub.io/api/v1 |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | Port for the HTTP server. | 3010 |
MCP_HTTP_ENDPOINT_PATH | HTTP endpoint path where the MCP server is mounted. | /mcp |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (RFC 5424: debug, info, notice, warning, error). | info |
STORAGE_PROVIDER_TYPE | Storage backend: in-memory, filesystem, supabase, cloudflare-kv/r2/d1. | in-memory |
OTEL_ENABLED | Enable OpenTelemetry instrumentation (spans, metrics, completion logs). | false |
See .env.example for the full list of optional overrides.
# One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker build -t finnhub-mcp-server .
docker run --rm -e MCP_TRANSPORT_TYPE=http -e FINNHUB_API_KEY=your-key -p 3010:3010 finnhub-mcp-serverThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/finnhub-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Directory | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers tools/resources and inits the Finnhub service. |
src/config | Server-specific environment variable parsing and validation with Zod. |
src/mcp-server/tools | Tool definitions (*.tool.ts). Six tools across symbols, quotes, company, earnings, news, and recommendations. |
src/mcp-server/resources | Resource definitions (*.resource.ts). News-categories reference. |
src/services/finnhub | Finnhub REST client — auth, typed endpoint methods, retry, and HTTP-status classification. |
tests/ | Unit and integration tests mirroring src/. |
See CLAUDE.md / AGENTS.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagesrc/mcp-server/*/definitions/index.tsIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.