Financial-Research-Investment-Assistant (Talantan1102/Financial-Research-Investment-Assistant) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 67 tools. No publisher has claimed this listing.

Warning

74/100

Financial-Research-Investment-Assistant

Item: Financial-Research-Investment-Assistant
Rating: 74
Author: M8ven

→ Talantan1102/Financial-Research-Investment-Assistant · listed on github_code

Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

Talantan1102

Source: github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

🚨

Code appears obfuscated

2 files are unreadable to a human reviewer. Cannot audit what they do.

🔐

You'll be asked for 3 credentials: DASHSCOPE_API_KEY, TUSHARE_TOKEN, RUN_CHAT_AUTH_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes67 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

_call_tool

compare_stocks

get_corporate_actions

get_financial_statements

get_daily

get_fund_nav

查基金类型与每日净值涨跌(场内ETF/场外基金)。组合里基金的涨跌用它。看不穿底层持仓。

get_index_daily

查指数日线与当日涨跌幅(沪深300=000300.SH,上证=000001.SH 等)。

get_news

get_sector_daily

查个股所属申万行业 + 该板块当日涨跌幅。持仓监控看板块表现时用。

get_stock_quote

kb_search

lookup_ts_code

get_market_indicators

trade_cal

web_search

archival_memory_insert

archival_memory_search

archival_memory_traverse

core_memory_append

core_memory_replace

recall_memory_search

codeinterpreter

askuser

approval

offerdeepresearch

readcachedresult

managewatchlist

_marketpermission

getmarketentitlements

checkordereligibility

getentitlementapplicationlink

memorysearch

memorywrite

_paper

getpaperaccount

listpaperorders

getpaperorder

placepaperorder

cancelpaperorder

resetpaperaccount

getportfoliopositions

loadskill

runskillscript

getbalancesheet

getcashflow

getdailybasic

getdividendhistory

getfinancials

getforecast

getfundnav

getholderchange

getindexdaily

getmoneyflow

getnews

getpehistory

getsectordaily

getstockdaily

stockquote

kbsearch

lookuptscode

_mcptoolproxy

websearch

verlbackendtooladapter

httptoolproxy

dynamic_tool_172

dynamic_tool_367

inprocess

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configHARNESS_BOARD_MILVUS_HOST

configHARNESS_BOARD_MILVUS_PORT

configBACKEND_BASE_URL

configMILVUS_HOST

configMILVUS_PORT

configCHAT_MEMORY_COLLECTION_NAME

configD3_SKILLS_ROOT

configD3_WORKDIR_ROOT

configD3_TOOL_PORT

configSMOKE_MODEL

🔐 secretDASHSCOPE_API_KEYLLM key，对话和研报需要

configLLM_BASE_URL

configCORS_ORIGINS

🔐 secretTUSHARE_TOKEN真实 A 股行情和财务数据

configTUSHARE_BASE_URL

configKB_MODE知识库向量检索，需要 Milvus

configRUN_CHAT_BASE_URL

configRUN_CHAT_TENANT_ID

🔐 secretRUN_CHAT_AUTH_TOKEN

configRUN_CHAT_SMOKE_PROMPT

configRUN_CHAT_SMOKE_TIMEOUT_SECONDS

configHARNESS_MEMORY_PATH

configEMBEDDING_MODE

Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.

deployREDIS_URL

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

67/67 tools missing one or more hints — _call_tool (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); compare_stocks (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_corporate_actions (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +64 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tool test coverage

23/67 tools referenced in tests (34%)

Write tests that reference each tool by name so every tool has at least one test.

No eval / new Function

2 eval() or new Function() calls — dynamic code execution

Replace eval / Function with explicit parsing or safer alternatives.

Readable source code

2 files are minified or bundled, which is usually build output rather than concealment

Ship unminified, readable source.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/talantan1102/financial-research-investment-assistant?variant=verified)](https://m8ven.ai/mcp/talantan1102/financial-research-investment-assistant)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: 8dd9f325ca4baf4886d8880c77ff4eebb79f0b5c

code hash: 0b59c227c638497510a46b224e1c5ac4759d101ca9cab0f8bf4d0a70a1e78847

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client