FinanceToolkitBLOCK
Transparent and Efficient Financial Analysis
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/JerBouma/FinanceToolkit)
[](https://github.com/sponsors/JerBouma) [](https://www.buymeacoffee.com/jerbouma) [](https://www.linkedin.com/in/boumajeroen/) [](https://www.jeroenbouma.com/projects/financetoolkit/mcp) [](https://github.com/JerBouma/FinanceToolkit/releases/latest/download/financetoolkit.mcpb) [ | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (6 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
return pickle.loads(zlib.decompress(payload)) # noqa: S301
return pickle.loads(zlib.decompress(payload)) # noqa: S301
calculation = eval(formula_adjusted) # noqa
url, headers=headers, timeout=timeout, verify=False # noqa
example_portfolio.xlsx
module = importlib.import_module(_CLASSES[name])
module = importlib.import_module(module_path)
- Key Rate Duration = -(Dirty Price(Key Rate + Δy) - Dirty Price(Key Rate - Δy)) / (2 * Dirty Price * Δy)
and Δy is the shock applied to the key rate only (1 basis point by default).
- %ΔPrice ≈ -Modified Duration * Δy + 0.5 * Convexity * Δy^2
annual by default), Δy is the yield change (0.01 by default) and %ΔPrice is the change of the full
λ = s / (1 - R), P(default within t years) = 1 - e^(-λt)
companies = Toolkit(["AAPL", "MSFT"], api_key="FINANCIAL_MODELING_PREP_KEY", start_date="2017-12-31")
discovery = Discovery(api_key="FINANCIAL_MODELING_PREP_KEY")
funds = Toolkit(["VOO", "QQQ", "RSP"], api_key="FINANCIAL_MODELING_PREP_KEY")
"Permanent Portfolio", start_date="2016-01-01", api_key="FINANCIAL_MODELING_PREP_KEY"
discovery = Discovery(api_key="FINANCIAL_MODELING_PREP_KEY")
balance_dataset.pickle
cash_dataset.pickle
historical_dataset.pickle
income_dataset.pickle
.pre-commit-config.yaml
.mcpbignore
return_value=MagicMock(cafile="/etc/ssl/cert.pem"),
return_value=MagicMock(cafile="/etc/ssl/cert.pem"),
Gates applied: no_behavioural_pass.
a79cdd363706full audit observations/trust-audit/mcp-server/jerbouma__financetoolkit.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-25 | a79cdd363706 | BLOCK | F | 46 | first audit |
Questions
What is the FinanceToolkit MCP server?
Transparent and Efficient Financial Analysis
Is FinanceToolkit safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (46/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does FinanceToolkit need?
It reads FINANCIAL_MODELING_PREP_API_KEY, FRED_API_KEY and FT_MCP_SECRET_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does FinanceToolkit run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as financetoolkit.
How current is this page?
The grade is for one exact copy of the source (a79cdd363706), read on 2026-10-25. The repository is watched and re-audited when it changes.
Add this badge to your README
Shows this page's audit result and links back to it. It updates when the audit does.
[](https://modelsatlas.com/mcp/jerbouma/financetoolkit/)
Not your listing, or something out of date? Claim or update your listing.