Mcp Alphavantage — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Alphavantage (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Alpha Vantage's REST API for stock prices, fundamentals, technical indicators, forex, crypto, and economic indicators. ~20+ years of historical equities data, real-time-ish quotes (15-minute delayed on free tier), and structured fundamental data parsed from SEC filings.
Part of Pipeworx — an MCP gateway connecting AI agents to 1856+ live data sources. This is an independent, unofficial integration — not affiliated with, endorsed by, or published by the upstream provider.
Where SEC EDGAR gives you raw filings, Alpha Vantage gives you cleaned-up structured data ready for analysis: income statements, balance sheets, cash flow, key ratios, recent earnings, technical indicators. For real-time-ish quotes during market hours, this is the source.
Common flows:
av_quote({symbol: "AAPL"}) → latest price, change, volume.av_income_statement({symbol: "AAPL"}).av_earnings({symbol: "NVDA"}).av_daily({symbol: "AAPL"}).Used by the fintech_company_deep_dive compound for the quote + income statement layer alongside SEC EDGAR.
This pack is BYO-only as of 2026-09-02 (Bruce's ruling on fleet #1117). Pipeworx does not supply a key: the gateway entry no longer names PLATFORM_ALPHAVANTAGE_KEY, so _apiKey is whatever you pass and nothing else. Call it with no key and you get a refusal that says the pack requires an API key and names two working substitutes — no upstream call is spent producing it.
A FREE Alpha Vantage key will not work here, whoever it belongs to. Alpha Vantage meters its free tier by SOURCE IP and never validates the key at all — measured 2026-09-02 on three real keys plus the invented string ZZZZINVALIDKEY99, which drew the same "25 requests per day" refusal from our gateway that a real key did, and returned real IBM data from a laptop in the same minute (fleet #1070; the full measurement is in the header of src/index.ts). Because the address the call leaves from is what is spent, your free key is refused through the gateway for exactly the reason ours was. That also means a laptop test proves nothing about this pack: any string "works" from an IP with budget left.
What does work: a PAID key. Premium ($50–250/mo) is the one thing Alpha Vantage actually authenticates — its premium endpoints refuse a free key by name. Untested from here, since we do not hold one, so treat it as an inference rather than a measurement. Pass it via _apiKey.
If you have no paid key, use the substitutes the refusal names, both of which answer these questions today:
get_company_financials (sec-xbrl pack) — US income statements, balancesheets and cash flow, keyless, no daily cap. Covers everything av_overview / av_income_statement / av_balance_sheet / av_earnings do for US filers.
Covers av_quote, and non-US symbols.
The "demo" key: Alpha Vantage advertises demo as a no-signup key, but it returns errors for most calls, and through the gateway it hits the same IP meter as any other free key. The pack refuses it explicitly.
Pipeworx caches with TTLs aligned to these.
from Pipeworx, where a free key never gets as far as the per-minute limit.
cap on YOUR key is gone, every tool in this pack fails with auth_required and the words "the daily request allowance behind this key is spent" — deliberately, so the gateway can attach a credential block saying whose key ran out. It used to answer {found:false, reason:"quota_exceeded"}, which reads as a successful call to every consumer that does not parse prose, and a spent key was reported healthy for weeks (fleet #1091). A SHORT throttle — a notice naming only a per-minute frequency — is still a soft {found:false, reason:"rate_limit"}, because that one really does clear on its own. Since #1117 that block can only ever say caller: the pack left the platform-key probe rotation along with the platform key, so there is no Pipeworx allowance left to spend.
BARC.LON). Default endpoints assume US-listed.Add to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):
{
"mcpServers": {
"alphavantage": {
"url": "https://gateway.pipeworx.io/alphavantage/mcp"
}
}
}tools/list at https://gateway.pipeworx.io/alphavantage/mcp returns the tools in the table above plus the shared Pipeworx meta-tools — ask_pipeworx, discover_tools, search_within, remember/recall and the rest of the gateway-wide set. So the tool count you see is larger than this table: a single-pack endpoint currently lists roughly 30 shared tools alongside the pack's own. The connection's initialize response states its exact scope, and is the authoritative answer for a given day.
This is deliberate, not multiplexing by accident. The meta-tools are what let a scoped connection answer a question this pack does not cover — via ask_pipeworx, which routes across the whole catalog — without you adding a second MCP server. There is currently no way to mount a pack endpoint without them; if the extra schemas cost you more context than the routing is worth, connect to the full gateway once rather than to several pack endpoints.
Or connect to the full Pipeworx gateway to get every pack's tools listed directly, instead of just this one's:
{
"mcpServers": {
"pipeworx": {
"url": "https://gateway.pipeworx.io/mcp"
}
}
}Both URLs reach the same gateway and the same 1856+ data sources. The only difference is which pack's tools are listed directly; ask_pipeworx reaches all of them from either one.
Our alphavantage key is reserved for paid accounts, so an anonymous call to POST https://gateway.pipeworx.io/v1/tools/av_quote needs your own key passed as _apiKey alongside the arguments. Inspect any tool: GET https://gateway.pipeworx.io/v1/tools/av_quote. Find one: POST https://gateway.pipeworx.io/v1/tools/search_packs with {"query":"..."}.
@pipeworx/mcp-alphavantage is a local stdio bridge to the Pipeworx gateway: your MCP client starts it with npx, and it forwards every call to the same https://gateway.pipeworx.io/alphavantage/mcp endpoint shown above. It needs network access; there is no offline mode.
{
"mcpServers": {
"alphavantage": {
"command": "npx",
"args": ["-y", "@pipeworx/mcp-alphavantage"]
}
}
}Without a key it calls anonymously, capped at 50 calls a day. A free account raises that to 200 a day: get a key at https://pipeworx.io/signup and add "env": { "PIPEWORX_API_KEY": "<your key>" } to the server entry. The key is sent as a Bearer token, the same way a hosted connection sends it, so calls are metered and billed exactly as they are there.
It lists only this pack's tools by default. Set PIPEWORX_META_TOOLS=1 to also list ask_pipeworx and the other gateway-wide tools.
Behind an HTTPS proxy: Node's built-in fetch does not read HTTPS_PROXY by default. Newer Node releases honour it when NODE_USE_ENV_PROXY=1 is set; check your Node version's documentation.
Instead of calling tools directly, you can ask questions in plain English — this works on the pack endpoint above as well as on the full gateway:
ask_pipeworx({ question: "your question about Alphavantage data" })The gateway picks the right tool and fills the arguments automatically.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.