Atlas / MCP servers / options-analysis-suite / options-analysis-suite

options-analysis-suiteSAFE

mcp/options-analysis-suite/options-analysis-suite-mcp

AI integration for Options Analysis Suite - 46 data tools across Claude, ChatGPT, and Perplexity for personalized options trade analysis

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
47 46r · 1w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
1
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

MCP server that gives Claude, ChatGPT, Perplexity, and Grok direct access to your options analysis data, market research tools, portfolio risk snapshots, and platform context.

Supported Platforms

Current Tool Surface

The MCP currently exposes 46 tools - consolidated into enum-driven unified tools where tool shapes are a clean family match (calendars, regime views, Treasury rates, FINRA short-side series, user snapshots, and options-market screeners).

  • 38 market, research and pricing tools, six of them live
  • 6 synced user-data tools
  • 2 platform-context tools

Six tools read in real time from the broker connected to your account: get_live_quote, get_intraday_bars, get_live_options_chain, get_live_dealer_positioning, scan_option_strategies and rank_live_skew_gex (Pro and above). The other market tools answer from the platform's stored data - end-of-day snapshots and history, plus the intraday regime scans behind get_regime with scope='intraday' - and the synced tools from your own account data. compute_black_scholes prices from the inputs you give it. compute_scenario reprices a strategy you describe, with an optional fit against the positions you hold. get_regime_fits, compute_black_scholes and compute_scenario also need Pro; none needs a broker. A tool that needs more than the account has says so, with the upgrade link, rather than being hidden.

Market And Research Tools

Volatility, chain, and pricing structure

  • IV History (get_iv_history) - H
Read from source at commit 572e886d8ae8OBSERVED · 2026-10-10
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add mcp-server --env MCP_PROXY_SECRET=${MCP_PROXY_SECRET} --env OAS_AUTH_SERVER_URL=${OAS_AUTH_SERVER_URL} --env OAS_MCP_HANDOFF_SECRET=${OAS_MCP_HANDOFF_SECRET} --env OAS_PASSWORD=${OAS_PASSWORD} -- npx -y @oas/[email protected]
claude-desktop
{
  "mcpServers": {
    "mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@oas/[email protected]"
      ],
      "env": {
        "MCP_PROXY_SECRET": "${MCP_PROXY_SECRET}",
        "OAS_AUTH_SERVER_URL": "${OAS_AUTH_SERVER_URL}",
        "OAS_MCP_HANDOFF_SECRET": "${OAS_MCP_HANDOFF_SECRET}",
        "OAS_PASSWORD": "${OAS_PASSWORD}"
      }
    }
  }
}
03

Exposed tools (47)

46 read · 1 write · 0 destructive.

ToolRiskDescription
XreadD
compute_black_scholesread
compute_scenarioread
get_activist_filingsread
get_analysis_historyread
get_analysis_rollupsread
get_analyst_dataread
get_company_profileread
get_compute_runsread
get_congress_tradesread
get_custom_indicator_specread
get_dark_pool_dataread
get_dealer_positioningread
get_dividendsread
get_earningsread
get_fail_to_deliverread
get_fft_resultsread
get_fundamentalsread
get_greeks_historyread
get_insider_tradingread
get_institutional_ownershipread
get_intraday_barsread
get_iv_historyread
get_iv_surfaceread
get_live_dealer_positioningread
get_live_options_chainread
get_live_quoteread
get_market_calendarread
get_newsread
get_options_analytics_historyread
get_options_chainread
get_options_snapshotread
get_platform_inforead
get_ratesread
get_regimeread
get_regime_fitsread
get_sec_filingsread
get_short_dataread
get_snapshotread
get_stock_pricesread
get_stock_splitsread
get_threshold_historyread
get_trading_haltsread
query_analysisread
rank_live_skew_gexread
run_screenerwrite
scan_option_strategiesread
04

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
UNDECLARED (4 observation(s))
Network
declared (5 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (9)

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/tools/market/activistFilings.ts:3
import type { ProxyClient } from '../../proxy/proxyClient.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/tools/market/analystData.ts:3
import type { ProxyClient } from '../../proxy/proxyClient.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/tools/market/blackScholes.ts:3
import type { LiveApiClient } from '../../proxy/liveApiClient.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/tools/market/calendar.test.ts:3
import type { ProxyClient } from '../../proxy/proxyClient.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/tools/market/calendar.ts:3
import type { ProxyClient } from '../../proxy/proxyClient.js';
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
src/auth/authClient.ts:24
return atob(padded);
LOWObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
src/tools/helpers.test.ts:1104
expect(JSON.stringify(result)).not.toMatch(/[]/);
LOWObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
src/tools/helpers.test.ts:1108
expect(JSON.stringify(sanitizeMcpWireOutput(deep))).not.toMatch(/[]/);
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, zod, @types/bun
Why it matters. 3 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-10 · audit v0.4.1 · source sha 572e886d8ae8full audit observations/trust-audit/mcp-server/options-analysis-suite__options-analysis-suite-mcp.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-10572e886d8ae8SAFEB89first audit
06

Questions

What is the options-analysis-suite MCP server?

AI integration for Options Analysis Suite - 46 data tools across Claude, ChatGPT, and Perplexity for personalized options trade analysis

What tools does options-analysis-suite expose?

47 in total: 46 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is options-analysis-suite safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does options-analysis-suite need?

It reads MCP_PROXY_SECRET, OAS_AUTH_SERVER_URL, OAS_MCP_HANDOFF_SECRET, OAS_PASSWORD and OAS_TOKEN_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does options-analysis-suite run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @oas/mcp-server at 1.0.0.

How current is this page?

The grade is for one exact copy of the source (572e886d8ae8), read on 2026-10-10. The repository is watched and re-audited when it changes.

Advertisement