Loading…
Forex and crypto trading analysis with real-time data across 127+ instruments
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 27 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The forex-gpt-mcp MCP server exposes 45 tools, focused primarily on web, network, and communication capabilities. Its published description reads: "Forex and crypto trading analysis with real-time data across 127+ instruments". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates forex-gpt-mcp F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Tool input schema requests a secret" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check forex-gpt-mcp's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add forex-gpt-mcp to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.forex-gpt.ai/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Save your OANDA API Key and Account ID securely. These are required before you can trade.
Remove/Delete your stored OANDA API Key and Account ID. Use this if you want to clear your credentials or switch accounts.
Modify an existing trade's Stop Loss and Take Profit. You can use absolute prices OR relative distances. Only provided fields will be updated. Args: trade_id: The ID of the open trade to modify. take_
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: save_oanda_credentials
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_market_hours
A tool description tries to alter the model’s use of another tool.
ng or bulk data fetch. Args: instrument: Specific inRecommendationDescriptions must describe only their own tool.
tool: get_market_categories
A tool description tries to alter the model’s use of another tool.
be queried with get_market_hours. Returns: List of categories wRecommendationDescriptions must describe only their own tool.
tool: refresh_instrument_data
A tool description tries to alter the model’s use of another tool.
credentials via save_oanda_credentials. Returns: - success: Boolean iRecommendationDescriptions must describe only their own tool.
tool: economic_events
A tool description tries to alter the model’s use of another tool.
Fetch upcoming economic events via the TradingView prRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: save_oanda_credentials
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_oanda_credentials
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: trade_modify_trade
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: trade_market_order
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: trade_limit_order
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: trade_stop_order
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: cancel_pending_order
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: replace_pending_order
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: get_open_trades
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_open_positions
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_account_history
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_trade_details
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_order_history
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_pending_orders
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_trading_account
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: close_trade
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: close_position
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: get_market_hours
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: is_market_open
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_instrument_specs
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: refresh_instrument_data
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_token_balances
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: analyze_asset
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: analyze_watchlist
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: analyze_timeframes
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: economic_events
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_blog_articles
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: health
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_chart_data
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_live_heatmap
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: fetch
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: scan_market
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_spreads
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_price_stream_url
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_sentiment_stream_url
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: chart_chat_proxy
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
The server exposes one or more ui:// (MCP Apps) resources whose HTML/JS renders inside the host client — a client-side injection / data-exposure surface most scanners ignore. Flagged for review, not damning on its own.
33 ui:// resource(s); e.g. ui://widget/spread-card.htmlRecommendationReview each ui:// resource’s markup and scripts; treat host-rendered UI as untrusted, sandbox it, and never expose secrets or conversation context to it.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Place a Market Order. units: Positive for Buy, Negative for Sell take_profit: ABSOLUTE PRICE (e.g. 1.1250). stop_loss: ABSOLUTE PRICE (e.g. 1.1100). take_profit_distance: RELATIVE PIPS (e.g. 0.0050).
Place a Limit Order. price: The limit price to trigger the order. take_profit: ABSOLUTE PRICE (e.g. 1.1250). stop_loss: ABSOLUTE PRICE (e.g. 1.1100). take_profit_distance: RELATIVE PIPS (e.g. 0.0050).
Place a Stop Order (Momentum/Breakout Entry). Use this to Buy ABOVE market price or Sell BELOW market price. Args: instrument: Asset symbol (e.g. 'EUR_USD') units: Positive for Buy, Negative for Sell
Cancel a pending (unfilled) Limit or Stop order. Args: order_id: The OANDA ID of the order to cancel.
Replace (Modify) an existing pending order. Basically cancels the old one and places a new one atomically. Args: order_id: ID of the order to replace. type: 'LIMIT' or 'STOP'. (All other args same as
List open trades.
List open positions (Net Exposure per instrument). Useful to see total Long/Short units and P&L per pair.
Get account transaction history (e.g. closed trades, order fills). Useful for finding past trades, reporting, or auditing. Args: from_time: Start time (RFC3339 format, e.g. "2023-05-01T00:00:00Z"). to
Get full details of a specific trade (Open or Closed). Useful to investigate a trade that disappeared or to see its full history.
Get OANDA order history (FILLED, CANCELLED, TRIGGERED, etc.). state: "ALL", "PENDING", "FILLED", "TRIGGERED", "CANCELLED". count: Max 500.
List all PENDING orders (Limits, Stops, Entry Orders). These are orders waiting to be filled.
Get trading account summary (balance, margin).
Close a specific trade (fully or partially).
Close position for an instrument.
Get trading hours for instruments. Use for session planning or bulk data fetch. Args: instrument: Specific instrument (e.g., "EUR_USD", "US30_USD"). If None, returns all. category: Filter by category
Check if a specific market is currently open for trading. Args: instrument: The OANDA instrument name (e.g., "EUR_USD", "US30_USD", "XAU_USD"). at_time: Optional ISO8601 datetime to check (e.g., "2024
Get all available market categories and instrument counts. Useful for understanding what categories can be queried with get_market_hours. Returns: List of categories with counts and sample instruments
Get instrument specifications (precision, limits, margin, financing rates). Args: instrument: Specific instrument (e.g., "EUR_USD"). If None, returns all or filtered by type. type_filter: Filter by ty
Manually refresh instrument data from OANDA API. Updates financing rates, margin requirements, and other parameters. Requires: User must have saved OANDA credentials via save_oanda_credentials. Return
Check the status of the instrument data cache. Returns: - ageHours: How old the cached data is - isStale: True if data is older than 24 hours - lastRefreshed: When the cache was last updated - instrum
Return the current user's token balances from Auth0 app_metadata. Uses _safe_profile() so that the same values shown inside AI analysis (token_quota, purchased_tokens, total_token_usage, last_reset, e
Return supported asset symbols from config.OANDA_UNIVERSE. Optional: • filter: substring (case-insensitive) to narrow the list • asset: specific symbol to test membership
Run a one-shot technical analysis for a single asset/timeframe. Args: asset: Asset symbol (e.g., EUR_USD, XAU_USD) timeframe: Timeframe for analysis (D, H4, H1, etc.) priceType: Price type - B (bid),
View the current assets in your saved watchlist. Returns: List of saved assets and count.
Add a new asset to your persistent watchlist. Args: asset: Asset symbol (e.g. 'EUR_USD', 'BTC_USD')
Remove an asset from your persistent watchlist. Args: asset: Asset symbol to remove
Analyze multiple assets from the user's SAVED watchlist in parallel. Args: timeframe: Timeframe (D, H4, H1, etc.) priceType: B (bid), A (ask), or M (mid) timeoutSec: Overall timeout in seconds (30-300
Analyze a single asset across multiple timeframes simultaneously. Args: asset: Asset symbol (e.g., EUR_USD) timeframes: List of timeframes (e.g., ["D", "H4", "H1"]) priceType: B (bid), A (ask), or M (
Fetch upcoming economic events via the TradingView proxy source. Args: fromDays: Start of date range (days from now, 0-90) toDays: End of date range (days from now, 0-90) Returns: List of economic eve
Get recent articles from the Forex-GPT blog feed. Args: max_results: Maximum number of articles to return (1-50, default: 10) Returns: List of recent blog articles with titles, URLs, summaries, images
Comprehensive health and status check including optional upstream dependencies. Args: checkOpenAI: Verify OpenAI API connectivity checkTradingView: Verify TradingView API connectivity checkOANDA: Veri
Retrieve OHLC (candlestick) data for charting. Args: asset: Asset symbol (e.g., EUR_USD) timeframe: Timeframe (D, H4, H1, etc.) count: Number of candles (50-5000) Returns: Candlestick data with timest
Generates a real-time Sentiment Heatmap snapshot. Behavior: 1. If 'assets' are provided, scans those specific assets. 2. If 'assets' not provided, scans the user's saved Watchlist. 3. If Watchlist is
Search forex analysis results by asset name, timeframe, or keywords. Returns a list of available analyses matching the search criteria. Args: query: Search query (e.g., "EUR_USD", "daily analysis", "g
Retrieve complete forex analysis by ID. Args: id: Analysis ID in format "ASSET_TIMEFRAME" (e.g., "EUR_USD_D", "XAU_USD_H4") Returns: Full analysis document with technical indicators, signals, and reco
Scans the entire market universe (Forex, Crypto, Metals, Indices) to find the strongest trading opportunities. Args: timeframes: List of timeframes to scan (e.g. ["H1", "H4", "D"]). Default is ["H8"].
Checks the current liquidity and trading cost (spread) for an asset. Useful for checking if a market is too expensive to trade right now. Args: asset: The asset symbol (e.g., "EUR_USD", "XAU_USD") Ret
Return the server's current UTC timestamp (ISO 8601).
Master tutorial for MCP tools: usage tips, key parameters, and suggested flows.
Return a short-lived URL for the raw price stream (SSE) for given instruments. The URL expires after ~10 minutes.
Return a short-lived URL for the sentiment stream (SSE) for given instruments and granularity. The URL expires after ~10 minutes.
Proxy to the Flask /api/chart-chat endpoint using the caller's bearer token. Keeps token accounting/auth consistent with the web app while exposing chat via MCP.