ModelsAtlas
Explore
Atlas / MCP servers / hbhqq9 / hbhqq9-bde-score

hbhqq9-bde-scoreBLOCK

mcp/hbhqq9/bde-score
MCP server by hbhqq9 · a shares · ai agents · blockchain · Audited 2026-10-12
⚑ Report / re-scanSource ↗

🏆 Open-source multi-factor stock scoring API (0-100) | US/HK/A-Share 74 stocks | Zero signup | shields.io badges | GitHub Action | EU AI Act compliant

Verdict
BLOCK
Grade
F
Trust score
46 /100
Exposed tools
5 5r · 0w · 0d
Transport
stdio · streamable-http
License
NOASSERTION
Stars
3
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

AI-Powered Multi-Market Stock Analysis via Model Context Protocol

[](https://modelcontextprotocol.io) [](https://registry.modelcontextprotocol.io) [](#compliance) [](LICENSE)

🤖 What is BDE ScoreTM?

BDE ScoreTM is an MCP (Model Context Protocol) Server that gives AI agents direct access to transparent, multi-factor quantitative stock scoring across US, HK, and A-share markets.

It is not a REST API wrapper — it is a native MCP server built with the MCP SDK that exposes structured tools, each returning explainable 7-factor scores.

73 stocks · 3 markets · 6 MCP tools · One comparable score per stock.

🔧 MCP Tools

BDE Score exposes 6 MCP tools that AI agents can call directly:

Read from source at commit 915c472a0c91OBSERVED · 2026-10-12
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add bde-score --env ALPACA_API_KEY=${ALPACA_API_KEY} --env ALPACA_API_SECRET=${ALPACA_API_SECRET} --env MCP_API_KEY=${MCP_API_KEY} --env REGISTRY_API_KEY=${REGISTRY_API_KEY} -- npx -y @claude-plugins/[email protected]
claude-desktop
{
  "mcpServers": {
    "bde-score": {
      "command": "npx",
      "args": [
        "-y",
        "@claude-plugins/[email protected]"
      ],
      "env": {
        "ALPACA_API_KEY": "${ALPACA_API_KEY}",
        "ALPACA_API_SECRET": "${ALPACA_API_SECRET}",
        "MCP_API_KEY": "${MCP_API_KEY}",
        "REGISTRY_API_KEY": "${REGISTRY_API_KEY}"
      }
    }
  }
}
03

Exposed tools (5)

5 read · 0 write · 0 destructive.

ToolRiskDescription
batch_scorereadScore multiple stocks in one call. Returns ranked results with composite scores and factor breakdowns for each stock.
market_overviewreadGet overall market sentiment including average BDE score, breadth indicators, top/worst performers, and signal distribution.
score_stockreadScore a single stock using 7-factor composite model (VIX, Volume Profile, RSI, MACD, Bollinger, OBV, ATR). Returns composite score (0-100), signal classification, and factor breakdown.
top_performersreadGet top N performing stocks from a watchlist, sorted by composite score descending.
worst_performersreadGet worst N performing stocks from a watchlist, sorted by composite score ascending.
04

Trust audit

BLOCKgrade F · trust 46/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
declared (13 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (25)

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
agent-registry/registry_server.py:96
blocked_hosts = ['localhost', 'metadata.google.internal', '169.254.169.254']
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
deploy_futu_opend.sh:95
sudo apt-get update -qq
Why it matters. asks for elevated privileges
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
deploy_futu_opend.sh:96
sudo apt-get install -y -qq wget unzip curl
Why it matters. asks for elevated privileges
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
deploy_futu_opend.sh:99
sudo yum install -y -q wget unzip curl
Why it matters. asks for elevated privileges
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
deploy_futu_opend.sh:456
sudo cp /tmp/futu-opend.service "$SERVICE_FILE"
Why it matters. asks for elevated privileges
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
deploy_futu_opend.sh:457
sudo systemctl daemon-reload
Why it matters. asks for elevated privileges
MEDIUMInventory / provenance · inv.binary · CWE-1104
__pycache__/alpaca_adapter.cpython-313.pyc
alpaca_adapter.cpython-313.pyc
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
__pycache__/alpaca_client.cpython-313.pyc
alpaca_client.cpython-313.pyc
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
__pycache__/bde_api.cpython-313.pyc
bde_api.cpython-313.pyc
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
__pycache__/bde_stock_daily.cpython-313.pyc
bde_stock_daily.cpython-313.pyc
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
__pycache__/broker_adapter.cpython-313.pyc
broker_adapter.cpython-313.pyc
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMPrivilege escalation / persistence · fs.persistence · CWE-269, CWE-250
deploy_futu_opend.sh:459
log_warn "启动: sudo systemctl start futu-opend"
MEDIUMPrivilege escalation / persistence · fs.persistence · CWE-269, CWE-250
deploy_futu_opend.sh:460
log_warn "开机自启: sudo systemctl enable futu-opend"
MEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59
deploy_futu_opend.sh:424
SERVICE_FILE="/etc/systemd/system/futu-opend.service"
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
mcp/mcp_http_server.py:265
BDE_API_BASE = "http://127.0.0.1:8890"
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
share_card.py:20
API_BASE = "http://127.0.0.1:8890"
LOWInventory / provenance · inv.hidden_file · CWE-1104
.mcp/.tunnel_state.json
.tunnel_state.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
reports/.feishu_msg_20260723_1151.txt
.feishu_msg_20260723_1151.txt
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
reports/.feishu_msg_20260724_0551.txt
.feishu_msg_20260724_0551.txt
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
scripts/.balance_state.json
.balance_state.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.symlink · CWE-1104
SYSTEM_DNA.md
SYSTEM_DNA.md
Why it matters. link not followed
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
BDE_SCORE_SECURITY_AUDIT_20260710.md:26
- **验证**: `curl http://101.126.19.34:8890/` → 连接拒绝 ✅
LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
README.md:5
[![MCP Server](https://img.shields.io/badge/MCP-Server-blue?style=for-the-badge&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIxNiIgaGlnaHQ9IjE2IiB2aWV3Q
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
claude-code-plugin/plugins/mcp/bde-score/package.json
@modelcontextprotocol/sdk
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
requirements.txt
fastapi, uvicorn, pandas, numpy
Why it matters. 4 requirement(s) not pinned with ==
Fix. pin exact versions

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha 915c472a0c91full audit observations/trust-audit/mcp-server/hbhqq9__bde-score.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-12915c472a0c91BLOCKF46first audit
06

Questions

What is the hbhqq9-bde-score MCP server?

🏆 Open-source multi-factor stock scoring API (0-100) | US/HK/A-Share 74 stocks | Zero signup | shields.io badges | GitHub Action | EU AI Act compliant

What tools does hbhqq9-bde-score expose?

5 in total: 5 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is hbhqq9-bde-score safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (46/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does hbhqq9-bde-score need?

It reads ALPACA_API_KEY, ALPACA_API_SECRET, MCP_API_KEY and REGISTRY_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does hbhqq9-bde-score run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @claude-plugins/bde-score at 1.0.0.

How current is this page?

The grade is for one exact copy of the source (915c472a0c91), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement