MoomooSAFE
MCP Server for AI Agents to use Moomoo OpenAPI (https://www.moomoo.com/OpenAPI)
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
An MCP (Model Context Protocol) server for the Moomoo trading platform. This server allows AI agents (like Claude Desktop or Gemini) to access market data, account information, and execute trades via the moomoo-api Python SDK.
🚀 Build Your Own Trading Agent
Take your trading to the next level with AI!
This MCP server empowers developers to build custom trading skills and strategies. By integrating this tool, you can enable any compatible AI agent to interact directly with the Moomoo platform on your behalf. Whether you want an AI assistant that monitors the market, analyzes your portfolio, or automatically executes complex trading strategies, this server provides the seamless bridge between your custom AI logic and Moomoo's powerful trading infrastructure.
Features
- Market Data: Real-time quotes, historical K-lines, market snapshots, and order books.
- Account Management: Comprehensive account summaries, assets, positions, and cash flow analysis.
- Trading: Full order management including placing, modifying, and canceling orders.
- System Health: Built-in health checks and connectivity verification.
- Extensible Architecture: Built on FastMCP for easy extension of trading capabilities.
Tools
System
check_health: Check connectivity to Moomoo OpenD gateway and server health.
Account
get_accounts: List all trading accounts (REAL and SIMULATE).get_account_summary: Get a complete summary of assets and positions for an account.get_assets: Retrieve account assets (cash, market value, buying power).get_positions: Get current stock positions with P/L data.get_max_tradable: Calculate maximum tradable quantity for a specific stock.get_margin_ratio: Check margin ratios for specific stocks.get_cash_flow: Retrieve historical cash flow records.unlock_trade: Unlock trading access for REAL accounts.
Market Data
get_stock_quote: Get real-time stock quotes.
49365d677319OBSERVED · 2026-10-09Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add moomoo-api-mcp --env MOOMOO_TRADE_PASSWORD=${MOOMOO_TRADE_PASSWORD} --env MOOMOO_TRADE_PASSWORD_MD5=${MOOMOO_TRADE_PASSWORD_MD5} -- uvx moomoo-api-mcp{
"mcpServers": {
"moomoo-api-mcp": {
"command": "uvx",
"args": [
"moomoo-api-mcp"
],
"env": {
"MOOMOO_TRADE_PASSWORD": "${MOOMOO_TRADE_PASSWORD}",
"MOOMOO_TRADE_PASSWORD_MD5": "${MOOMOO_TRADE_PASSWORD_MD5}"
}
}
}
}Exposed tools (22)
18 read · 4 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
cancel_order | write | Cancel an existing order. |
check_health | read | Check connectivity to Moomoo and MCP server health. |
get_account_summary | read | Get complete account summary including assets and positions in one call. |
get_accounts | read | Get list of trading accounts. |
get_assets | read | Get account assets including cash, market value, buying power. |
get_cash_flow | read | Get account cash flow history. |
get_deals | read | Get list of today |
get_historical_klines | read | Get historical candlestick (K-line) data for a stock. |
get_history_deals | read | Get historical deals (executed trades). |
get_history_orders | read | Get historical orders. |
get_margin_ratio | read | Get margin ratio for stocks. |
get_market_snapshot | read | Get market snapshot for multiple stocks efficiently. |
get_max_tradable | read | Get maximum tradable quantity for a stock. |
get_order_book | write | Get order book (market depth) showing bid/ask price levels. |
get_orders | read | Get list of today |
get_positions | read | Get current positions. |
get_stock_quote | read | Get real-time stock quotes for specified codes. |
get_user_security | read | Get list of securities in a specific user-defined group (watchlist). |
get_user_security_group | read | Get list of user-defined security groups (watchlists). |
modify_order | write | Modify an existing order. |
place_order | write | Place a new trading order. |
unlock_trade | read | Unlock trade to access REAL account data. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (3)
To enable **REAL account** access, you must securely provide your credentials.
- Read `MOOMOO_TRADE_PASSWORD` or `MOOMOO_TRADE_PASSWORD_MD5` from environment variables
- Modify `server.py` to read these environment variables.
Gates applied: no_behavioural_pass.
49365d677319full audit observations/trust-audit/mcp-server/litash__moomoo.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-09 | 49365d677319 | SAFE | B | 89 | first audit |
Questions
What is the Moomoo MCP server?
MCP Server for AI Agents to use Moomoo OpenAPI (https://www.moomoo.com/OpenAPI)
What tools does Moomoo expose?
22 in total: 18 read-only, 4 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Moomoo safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Moomoo need?
It reads MOOMOO_TRADE_PASSWORD and MOOMOO_TRADE_PASSWORD_MD5 from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (49365d677319), read on 2026-10-09. The repository is watched and re-audited when it changes.