canaryBLOCK
Canary is a local risk desk for your brokerage account: daily brief, portfolio and market evidence, read-only MCP tools, CLI, paired app and a Go client. Runs with Interactive Brokers today; the broker layer is its own package. Gated broker actions need the separate trading build.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/osauer/canary/actions/workflows/ci.yml) [](https://github.com/osauer/canary/releases/latest) [](LICENSE)
A local risk desk for your brokerage account.
It runs with Interactive Brokers today, through IB Gateway or TWS, and keeps the broker layer in its own Go package, pkg/ibkr, so other brokers can follow.
Canary turns one local IB Gateway or TWS session into a daily brief, current portfolio and market evidence, and a broker-confirmed review of what past position changes delivered. Use the same daemon from an MCP host, the shell, or a paired phone. The standard binary and every MCP tool are structurally read-only: they contain no broker-order preview or execution surface.
Canary is for an IBKR Pro user who runs Gateway or TWS locally and wants stale, missing, or held evidence to remain visible. It is not a hosted brokerage service, a trade recommender, or a complete TWS API replacement. If you only need a Go wire-protocol client, use pkg/ibkr. To read a running Canary from your own Go program, import the module root github.com/osauer/canary/v2: it runs the same read-only tool catalogue over the daemon socket, and canarytest serves the wire types on a temporary socket for tests. The client also exposes a narrow audited cash-sweep ordering preference; its tool catalogue remains read-only and the preference cannot activate reserves or broker execution.
[Documentation](https://osauer.dev/canary/docs/) · Install · First session · Canary Edge · MCP tools · Safety · Privacy
Start
You need I
c94fe4122977OBSERVED · 2026-10-10Trust audit
BLOCKgrade F · trust 58/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (6 observation(s))
- Network
- declared (11 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
check-release-payload-inventory.sh
row := eval(set, c.pol.SetForBucket(set))
claude-plugin/.claude-plugin/plugin.json
claude-plugin/hooks
claude-plugin/scripts/canary-mcp.sh
claude-plugin/skills
Open the isolated Canary SPA at `http://127.0.0.1:8766/`. Never adopt, kill,
canary app --addr 127.0.0.1:8766 --public-url http://127.0.0.1:8766 --state-dir /tmp/ibkr-codex-preview-app-state-8766 --preview-read-grant
3. Open `http://127.0.0.1:8766/` in a Codex browser panel. Prefer the Codex app
APP_SMOKE_URL ?= http://127.0.0.1:8765
000000cb084d1219080012044d5346541a0353544b4205534d41525452035553441a8b010801180020002a03425559320132380042034c4d54490000000000987a405a0344415962084455313233343536e2010c707265766965772d74657374f00100f8
const token = "private-token-never-forward"
.nojekyll
check-release-payload-inventory_test.sh
const hash = (rule, s) => createHash("sha1").update(rule + "|" + s.toLowerCase().replace(/\s+/g, " ")).digest("hex").slice(0, 12);@go -C scripts/docgen/docs-html run . -root ../../.. -output-root ../../../dist/pages
ln -s ../../scripts/pre-commit "$repo/.git/hooks/pre-commit"
"$checker" --mode tag 'v1.2.3/../../unsafe' >/dev/null 2>&1
cmd := exec.Command("go", "build", "-ldflags", ldflags, "-o", out, "../../cmd/canary")canary app pair --public-url http://127.0.0.1:8765 --json
const binary = atob(raw);
const raw = atob((input + pad).replaceAll("-", "+").replaceAll("_", "/"));{"nonascii", func(p *SetupEvaluateParams) { p.Contract.Symbol = "SYNΘ" }},for _, bad := range []SetupCoverageParams{{Session: "2026-9-30"}, {Session: "2026-02-30"}, {Session: "latest"}, {Symbol: "AAA,BBB"}, {Symbol: "SYNΘ"}} {wrangler
Gates applied: no_behavioural_pass.
c94fe4122977full audit observations/trust-audit/mcp-server/osauer__canary.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | c94fe4122977 | BLOCK | F | 58 | first audit |
Questions
What is the canary MCP server?
Canary is a local risk desk for your brokerage account: daily brief, portfolio and market evidence, read-only MCP tools, CLI, paired app and a Go client. Runs with Interactive Brokers today; the broker layer is its own package. Gated broker actions need the separate trading build.
Is canary safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (58/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does canary need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (c94fe4122977), read on 2026-10-10. The repository is watched and re-audited when it changes.