Model Context Protocol moderate risk

Openapi

LongPort OpenAPI provides programmatic access to trading, quotes, and portfolio data, enabling custom trading tools and strategy analysis, secured via API keys and tokens.

Connections & Capabilities

Connects To

GitHub

Capabilities

readwrite

Exposed MCP Tools (5)

high

create_order

Creates a new trading order.

Can execute trades, potentially leading to financial loss.

high

amend_order

Modifies an existing trading order.

Incorrect modifications can lead to unintended trades.

moderate

cancel_order

Cancels a pending trading order.

Canceling the wrong order can have financial implications.

safe

query_quotes

Retrieves real-time or historical stock quotes.

Read-only operation, no side effects.

safe

query_portfolio

Retrieves real-time data about account assets and positions.

Read-only operation, no side effects.

Safety Assessment

The LongPort OpenAPI offers powerful trading and data access capabilities, but the ability to execute trades and access sensitive financial data introduces risk. Secure handling of API keys, access tokens, and adherence to best practices for secrets management are crucial. The availability of multiple SDKs can improve security if used correctly, but also increases the attack surface if vulnerabilities exist within the SDKs themselves.

Requires authentication via API Key, App Secret, and Access Token.
Provides both HTTP and WebSocket endpoints, allowing for different levels of interaction.
Clear documentation on environment variables and troubleshooting.
SDKs available in multiple languages, potentially aiding in secure implementation.

Trading functionality allows for creating, amending, and canceling orders, posing a financial risk.
Access to real-time quotes and portfolio data could be misused if credentials are compromised.
Reliance on environment variables for secrets management can be insecure if not handled properly.
No explicit mention of rate limiting, which could lead to abuse or denial-of-service.