Shinobidata — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Shinobidata (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
Aggregate score unchanged between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
<picture> <source media="(prefers-color-scheme: dark)" srcset="assets/logo-dark.svg"> <img src="assets/logo-light.svg" alt="ShinobiData" width="96" align="right" /> </picture>
Hook your AI client up to a real portfolio analyst. 32 tools for portfolio tracking, performance against benchmarks, fundamentals, sector and market views, screening, news. US equities, OAuth, free.
Works with Claude Desktop, ChatGPT (Plus / Teams / Enterprise), and any other MCP client.
English · 日本語 · 한국어 · Tiếng Việt
The AI does the orchestration. You ask the question.
Each question turns into 1 to 4 tool calls. The AI narrates. The data is real and cited.
/plugin marketplace add dark-horse-stocks/shinobidata
/plugin install shinobidata@shinobidataThat's the whole install. The first tool call opens an OAuth consent screen. Sign in with Google, click Allow, you're done. Run /reload-plugins to activate without restarting.
Plugin source lives in plugins/shinobidata/.
Edit ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"shinobidata": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://mcp.shinobidata.com/api/mcp/mcp"]
}
}
}Quit Claude (Cmd-Q, not just the window). Reopen. The OAuth flow runs once. Sign in with Google. That's it.
Settings → Connectors → Add Custom → paste https://mcp.shinobidata.com/api/mcp/mcp → authorize.
In Deep Research mode it picks up search and fetch automatically.
Streamable HTTP, OAuth 2.1 with PKCE. Point your client at https://mcp.shinobidata.com/api/mcp/mcp and it figures the rest out from the well-known endpoints.
Trouble? See docs/installation.md for the full walkthrough or docs/troubleshooting.md for the usual gotchas.
32 tools. Five buckets.
| Group | Tools | Scope |
|---|---|---|
| Portfolio CRUD | 6 | portfolio:write |
| Portfolio analytics | 6 | portfolio:read |
| Single-company research | 7 | market:read |
| Market and sector | 10 | market:read |
Discovery (screen, search, fetch) | 3 | market:read |
You only grant the scopes you want at the consent screen. Want it just for research and not let the AI touch your portfolio? Skip portfolio:write. Done.
Full per-tool catalog in docs/tools.md.
After installing, paste this:
Create a portfolio called "Test". Then add these holdings:
Symbol, Quantity, AvgCost
AAPL, 25, 180
NVDA, 50, 75
JPM, 25, 200
KO, 70, 60
PLTR, 80, 18
Now give me a full overview, then tell me which holdings are stagnating
and how concentrated I am sector-wise.That hits 6 tools (create_portfolio, parse_portfolio_text, add_holdings, get_portfolio_overview, get_growth_vs_stagnant, get_risk_summary). More prompts in examples/prompts.md.
flowchart LR
subgraph clients["AI clients"]
C["Claude"]
G["ChatGPT"]
O["Other MCP clients"]
end
subgraph backend["ShinobiData"]
OA["OAuth 2.1 (PKCE)"]
T["32 tools"]
DB[("Postgres + daily snapshots")]
end
C --> OA
G --> OA
O --> OA
OA --> T
T --> DBTwo design choices that matter.
Server aggregates, AI narrates. A 200-stock portfolio question returns the same JSON shape as a 5-stock one. Postgres does the heavy lifting overnight; the AI doesn't loop over rows. Most analytics calls return in under a second.
OAuth 2.1 end-to-end. No API keys in your config. PKCE S256 mandatory. Refresh tokens rotate. Tokens stored as SHA-256 hashes, never plaintext. Revoke from your account whenever you want.
Architecture writeup with the OAuth sequence diagram, the constant-size-response reasoning, and the RFCs we follow: docs/architecture.md.
If you just need price data piped to an LLM, the simple MCPs work fine. ShinobiData is heavier on the portfolio side and on the "what's the right next question" side.
search and fetch named per spec).Comparison reflects v1.0 (May 2026). Other MCPs evolve fast. PRs to update this welcome.
Already shipped:
com.shinobidata/researchUp next:
shinobidata.com/mcpanalyze_portfolio_fundamentalsDown the line:
web_search that fans out to Claude / Gemini / PerplexityIssues for bugs and tracked features. Discussions for ideas.
Short version:
Long version: <https://shinobidata.com/en/legal/privacy-policy> · <https://shinobidata.com/en/legal/terms>
Bug? Bug template.
Want a tool that doesn't exist yet? Start in Discussions → Ideas. Most tools that ship come from a real question someone tried to ask Claude or ChatGPT and couldn't.
Stuck installing? Discussions → Q&A or email <[email protected]>.
Translations and doc fixes are very welcome. The bar is "useful for a real reader", not perfect. See CONTRIBUTING.md.
MIT for everything in this repo (docs, examples, configs). Brand assets in assets/ are not MIT, see assets/README.md. The MCP server itself is hosted at mcp.shinobidata.com; the production codebase stays closed during alpha.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.