{ "markdown": "

\n \"Longbridge\"\n

\n\n

Longbridge MCP Server

\n\n

\n \"ChatGPT\n \"Claude\n \"Official\n \"Smithery\"\n \"LobeHub\"\n \"longbridge-mcp\n \"License\"\n \"Longbridge\"\n

\n\nOfficial MCP server for the [Longbridge](https://longbridge.com) brokerage. **163 tools** across real-time quotes, options, order routing, fundamentals, analyst ratings, calendars, IPO, price alerts, DCA plans, grid trading, portfolio analytics and community sharelists — covering **US and HK markets**. Built with Rust using [rmcp](https://github.com/anthropics/rmcp) and [axum](https://github.com/tokio-rs/axum).\n\n---\n\n

Now live in ChatGPT and Claude

\n\n

\n Longbridge is officially listed in the ChatGPT Apps directory and the Claude Connectors directory.
\n Talk to the markets in plain language — quotes, options, fundamentals, and your own portfolio —
\n with no config files to edit and no tokens to paste.\n

\n\n| | Add it in one place | Then just ask |\n|---|---|---|\n| **ChatGPT** | Settings → **Apps & Connectors** → add **Longbridge** | *\"How's NVDA trading today?\"* · *\"Show my HK positions\"* |\n| **Claude** | Settings → **Connectors** → add **Longbridge** (web · desktop · mobile) | *\"Compare AAPL and MSFT valuations\"* · *\"Any IPOs this week?\"* |\n\nSign in once with your Longbridge account. Every request runs over the same hosted, OAuth 2.1–secured endpoint documented below — read-only market data plus full account, portfolio, and trading tools, all gated by your own credentials.\n\n---\n\n## Highlights\n\n- **163 tools, one endpoint** — quotes, options, order routing, fundamentals, analyst research, screeners, IPO, alerts, DCA, grid trading and portfolio analytics across **US and HK markets**.\n- **Stateless by design** — every request forwards its Bearer token straight to the Longbridge SDK. No sessions, no database, nothing stored server-side.\n- **OAuth 2.1, auto-discovered** — RFC 9728 protected-resource and RFC 8414 authorization-server metadata; clients complete the flow with no token to paste.\n- **Clean, typed responses** — snake_case fields, RFC 3339 timestamps, human-readable symbols, and typed `outputSchema` descriptors for compatible clients.\n\nBuilt in Rust with [rmcp](https://github.com/anthropics/rmcp) and [axum](https://github.com/tokio-rs/axum).\n\n## Connect your own client\n\nLongbridge runs a hosted endpoint at **`https://mcp.longbridge.com`** — point any MCP client at it and complete OAuth when prompted. Authorization is auto-discovered via RFC 9728; there is no token to paste.\n\n**Claude Code**\n\n```bash\nclaude mcp add --transport http longbridge https://mcp.longbridge.com\n```\n\n**Claude Desktop** — add to `claude_desktop_config.json`, then restart:\n\n```json\n{ \"mcpServers\": { \"longbridge\": { \"url\": \"https://mcp.longbridge.com\" } } }\n```\n\n**Cursor · Cline · Windsurf · Zed · other clients** — point them at `https://mcp.longbridge.com` with transport `streamable-http`.\n\n
\nMore Claude Code commands\n\n```bash\n# Local self-hosted instance (see Self-hosting below)\nclaude mcp add --transport http longbridge-local http://localhost:8000/mcp\n\nclaude mcp list # registered servers\nclaude mcp get longbridge # config + auth status\nclaude mcp remove longbridge # unregister\nclaude mcp logout longbridge # re-trigger OAuth after revocation\n```\n\nOn first use, the client reads the `WWW-Authenticate` challenge, fetches `/.well-known/oauth-protected-resource` (RFC 9728), and opens your browser for the Longbridge OAuth flow. Tokens are cached per session and refreshed automatically.\n\n
\n\n## The 163 tools\n\nTwenty categories spanning market data, trading, research and account management.\n\n| Category | Count | Coverage |\n|----------|-------|----------|\n| **Quote** | 32 | Real-time and historical quotes, candlesticks, depth, brokers, options, warrants, watchlists, capital flow, market temperature, short positions, option volume |\n| **Fundamental** | 33 | Financial statements/reports, business segments, institutional views, industry peers/valuation, dividends, EPS forecasts, valuations & valuation comparison, company info/executives, shareholders, corporate actions, operating metrics |\n| **Trade** | 14 | Order submission/cancellation/replacement, positions, balance, executions, cash flow, margin |\n| **Market** | 15 | Market status, industry/top-mover rank, broker holdings, A/H premium, trade statistics, anomalies, short trades/margin, index constituents |\n| **DCA** | 9 | Dollar-cost averaging plan create/update/pause/resume/stop, execution history, statistics, support check |\n| **Grid** | 11 | Grid trading order submit/replace/cancel/suspend/restart, list/detail/trigger-history reads, per-symbol setup info, one-time strategy consent |\n| **Sharelist** | 8 | Community sharelist CRUD, member add/remove/sort, popular lists |\n| **IPO** | 7 | IPO subscriptions, calendar, listed stocks, order detail, profit/loss analysis |\n| **Content** | 7 | News list/detail, discussion topic CRUD and replies |\n| **Alert** | 5 | Price alert CRUD (add, delete, enable, disable, list) |\n| **Screener** | 5 | Stock screener search, indicators, strategy recommendation/management |\n| **Portfolio** | 4 | Exchange rates, profit/loss analysis (summary, detail, realized) |\n| **ATM** | 3 | Bank cards, withdrawal records, deposit records |\n| **Macrodata** | 2 | Macroeconomic indicator list and detail |\n| **Search** | 2 | News search, community topic search |\n| **Statement** | 2 | Account statement listing and export |\n| **Calendar** | 1 | Finance calendar (earnings, dividends, IPOs, macro data, closures) |\n| **Quant** | 1 | Run a quant indicator script against historical K-line data |\n| **Authenticate** | 1 | OAuth code exchange for clients that can't complete a browser redirect |\n| **Utility** | 1 | Current UTC time |\n\n## Self-hosting\n\nPrefer your own instance? Run the published image:\n\n```bash\ndocker run -p 8443:8443 \\\n -v /path/to/certs:/certs:ro \\\n ghcr.io/longbridge/longbridge-mcp \\\n --bind 0.0.0.0:8443 \\\n --base-url https://mcp.example.com \\\n --tls-cert /certs/cert.pem \\\n --tls-key /certs/key.pem\n```\n\n> **Set `--base-url`** to your externally reachable URL on any public deployment — it is published in the OAuth metadata clients use to discover the authorization server. It defaults to `http://localhost:{port}`, which remote clients cannot use.\n\nOr build from source: `cargo build --release && ./target/release/longbridge-mcp`.\n\n
\nConfiguration & environment variables\n\nConfig lives at `~/.longbridge/mcp/config.json` (override the directory with `LONGBRIDGE_MCP_CONFIG_DIR`). CLI flags take precedence. When `tls_cert` and `tls_key` are both set the server runs HTTPS, otherwise HTTP; `base_url` defaults to `https://localhost:{port}` with TLS or `http://localhost:{port}` without.\n\n| Option | Config Key | CLI Flag | Default | Description |\n|--------|-----------|----------|---------|-------------|\n| Bind address | `bind` | `--bind` | `127.0.0.1:8000` | HTTP server listen address |\n| Base URL | `base_url` | `--base-url` | auto | Public base URL for resource metadata |\n| Log directory | `log_dir` | `--log-dir` | *(stderr)* | Directory for rolling log files |\n| TLS certificate | `tls_cert` | `--tls-cert` | *(none)* | PEM certificate file for HTTPS |\n| TLS private key | `tls_key` | `--tls-key` | *(none)* | PEM private key file for HTTPS |\n\nAdvanced environment variables — most deployments never touch these; they exist for non-production Longbridge environments and SDK debugging.\n\n| Variable | Default | Description |\n|----------|---------|-------------|\n| `LONGBRIDGE_MCP_CONFIG_DIR` | `~/.longbridge/mcp` | Config file directory |\n| `LONGBRIDGE_HTTP_URL` | `https://openapi.longbridge.com` | Longbridge API base URL (also used for OAuth metadata) |\n| `LONGBRIDGE_PUBLIC_HOSTS` | *(none)* | Comma-separated hostnames accepted from the edge-injected `X-Host` header; matching requests echo that host in the 401 challenge / RFC 9728 metadata. Unset = `X-Host` ignored |\n| `LONGBRIDGE_GLOBAL_OAUTH_URL` | *(none)* | Authorization-server URL advertised to requests arriving via an allowlisted `X-Host` (global single-domain entry). Unset = fall back to `LONGBRIDGE_HTTP_URL` |\n| `LONGBRIDGE_QUOTE_WS_URL` | `wss://openapi-quote.longbridge.com/v2` | Quote WebSocket endpoint |\n| `LONGBRIDGE_TRADE_WS_URL` | `wss://openapi-trade.longbridge.com/v2` | Trade WebSocket endpoint |\n| `LONGBRIDGE_MCP_QUOTE_WS_IDLE_TTL_SECS` | `600` | Idle seconds before a cached quote WebSocket context is evicted |\n| `LONGBRIDGE_MCP_QUOTE_WS_MAX_CONTEXTS` | `1024` | Maximum cached quote WebSocket contexts per server process |\n| `LONGBRIDGE_MCP_LOG_PAYLOADS` | *(unset)* | `1` lifts the payload log caps (see below). Never set this in production |\n| `LONGBRIDGE_LOG_PATH` | *(none)* | SDK internal log path. **Leave unset in production** — the SDK writes unfiltered request/response bodies there |\n\n
\n\n
\nLogging & customer data\n\nMCP requests and responses carry customer data — cash balances, positions, order history — and upstream SDK frames carry access tokens. None of it belongs in a log file, so the server caps the log targets that would print it, independent of `RUST_LOG`:\n\n| Target | Cap | What it would otherwise print |\n|--------|-----|-------------------------------|\n| `longbridge_httpcli` | `warn` | OpenAPI request and full response bodies (INFO) |\n| `longbridge_wscli` | `warn` | Every WebSocket frame, auth token included (INFO) |\n| `longbridge::trade` | `warn` | Order push events (INFO) |\n| `rmcp` | `info` | Decoded MCP requests and full tool results (DEBUG), raw JSON-RPC frames (TRACE) |\n\nSo raising verbosity is safe: `RUST_LOG=debug` (or `trace`) gives you the server's own logs without leaking customer data. Two switches defeat this, both off by default — `LONGBRIDGE_MCP_LOG_PAYLOADS=1` (removes the caps; use only against a test account locally) and `LONGBRIDGE_LOG_PATH` (makes the SDK write unfiltered bodies to that directory; the server warns at startup when set).\n\n
\n\n
\nHTTP endpoints, authentication & metrics\n\nThe server expects a Longbridge OAuth access token in `Authorization: Bearer `. On missing or invalid auth it returns `401` with a `WWW-Authenticate` header pointing to the protected-resource metadata, which directs clients to the Longbridge OAuth authorization server.\n\n| Method | Path | Description |\n|--------|------|-------------|\n| GET | `/.well-known/oauth-protected-resource` | Protected Resource Metadata (RFC 9728) |\n| GET | `/.well-known/oauth-authorization-server` | Authorization Server Metadata (RFC 8414); advertises direct Longbridge authorize/register and proxied token/revoke endpoints |\n| POST | `/oauth2/token` | OAuth token proxy; derives `x-dc-region` from the code/refresh token, defaulting to AP |\n| POST | `/oauth2/revoke` | OAuth revocation proxy; derives `x-dc-region` from the token, defaulting to AP |\n| GET | `/metrics` | Prometheus metrics |\n| POST/GET/DELETE | `/mcp` | MCP Streamable HTTP endpoint (requires Bearer token) |\n\nPrometheus metrics: `mcp_tool_calls_total` (counter), `mcp_tool_call_duration_seconds` (histogram), and `mcp_tool_call_errors_total` (counter) — each labelled by `tool_name`.\n\n
\n\n## Development\n\n```bash\ncargo +nightly fmt # format\ncargo clippy # lint\ncargo test # test\n```\n\n## License\n\nReleased under the [MIT License](LICENSE).\n", "bytes": 12902, "sha": "6a3b1689001adf20693a32ba5f0efada88c34308b4a8ff412643ccb8be028781", "repo_slug": "longbridge/longbridge-mcp", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/mcp_com_longbridge_mcp_254782ee/readme" }