Back to MCP Trust Indexm8ven
62
/ 100
1 month ago
glama

fin-data-mcp-server

A Model Context Protocol server providing free financial market data across 13 categories with 83 no-key tools, enabling access to stocks, indices, options, forex, crypto, energy, prediction markets, and more.

→ CohenD/fin-data-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 8 credentials: ALPHAVANTAGE_API_KEY, EIA_API_KEY, EMBER_API_KEY, FINNHUB_API_KEY, FRED_API_KEY, OPENSKY_CLIENT_SECRET, QUIVER_API_KEY, TIINGO_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.18.0GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.18.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.18.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretALPHAVANTAGE_API_KEY— Commodities / Stocks / FX / Macro Alpha Vantage av_commodity, av_economic_indicator, av_time_series_daily, av_global_quote, av_fx_daily
configCACHE_TTL_MS
🔐 secretEIA_API_KEY— Energy EIA eia_browse_route, eia_data
🔐 secretEMBER_API_KEY— Energy Ember energy_ember_series
🔐 secretFINNHUB_API_KEY
🔐 secretFRED_API_KEY— Macro / news FRED fred_series_observations, fred_series_info, fred_search_series, fred_releases
configHOUSE_STOCK_WATCHER_URL— / SENATE_STOCK_WATCHER_URL if it moves.
configHTTP_TIMEOUT_MS
configOPENSKY_CLIENT_ID— OpenSky works anonymously (~400 credits/day); set /SECRET
🔐 secretOPENSKY_CLIENT_SECRET
🔐 secretQUIVER_API_KEY— Congressional / lobbying / contracts Quiver quiver_congress_trading, quiver_lobbying, quiver_gov_contracts, quiver_insider_trading
configSEC_USER_AGENT— e ="you@example.com" \
configSENATE_STOCK_WATCHER_URL— HOUSE_STOCK_WATCHER_URL / if it moves.
🔐 secretTIINGO_API_KEY— Stocks (premium backup) Tiingo tiingo_eod_prices, tiingo_metadata, tiingo_iex_intraday
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/cohend-fin-data-mcp-1flvkd)](https://m8ven.ai/mcp/cohend-fin-data-mcp-1flvkd)
commit: b4060af854e8ea4292156c675a1de9718893d5cb
code hash: dac65fe8838681d2d6e67a297242d47e7f1ffb302fa21a48dba376823d8c83a9
verified: 6/29/2026, 11:22:44 AM
view raw JSON →