Longbridge

com.longbridge由 longbridge.com 发布官方发布者v0.9.0更新于 Nov 2, 2026

US/HK markets — 163 tools: quotes, options, orders, fundamentals, screener, IPO, alerts, DCA & grid

已验证Streamable HTTP可网页运行金融数据与分析

概览

AI 生成的概览

Longbridge 官方券商 MCP 服务器，通过一个 OAuth 保护的端点让助手获取美股/港股行情、研究、持仓与实盘交易工具。

可以做什么
  • 获取实时与历史行情、K 线、盘口、期权、窝轮、资金流向与自选列表
  • 读取基本面、财务报表、分红、估值、机构观点、股东与公司行动
  • 提交、改单与撤单（含多腿期权组合单），并查看持仓、余额、成交与保证金
  • 管理定投计划、网格交易策略、价格提醒、IPO 认购、共享列表与社区话题
  • 筛选股票、对 K 线数据运行量化指标脚本，并获取财经日历、宏观数据、新闻与账户对账单
  • 用可选的 jq 风格表达式过滤任意工具的 JSON 响应
适用场景
适合希望助手回答美股或港股问题、研究公司、查看 Longbridge 持仓，或在聊天客户端中下单并管理交易与自动化策略的场景。
运行要求
需要 mcp.longbridge.com 远程端点（或自托管 Docker 镜像、Rust 构建）以及 Longbridge 账户。认证为 OAuth 2.1，使用 Authorization bearer 令牌并自动发现，无需粘贴令牌。自托管需 TLS 证书和可供 OAuth 元数据使用的公网 base URL。
安装前请注意
服务器提供完整交易工具，助手可提交、改单、撤单真实订单，创建定投与网格策略，并通过 ATM 工具操作银行卡与出入金记录。请求包含余额、持仓与订单历史，上游帧包含访问令牌。生产环境不要设置 LONGBRIDGE_MCP_LOG_PAYLOADS 与 LONGBRIDGE_LOG_PATH；过滤失败后不要自动重试下单等写操作。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Longbridge，将其添加到工作区。
  2. 连接 所需的 凭据。它们会被私密存储，绝不会在公开页面上展示。
  3. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/com.longbridge%2Fmcp/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。 客户端会在首次连接时完成 OAuth 登录。

{
  "mcpServers": {
    "longbridge": {
      "type": "http",
      "url": "https://mcp.longbridge.com/"
    }
  }
}

README

[Longbridge]

Longbridge MCP Server

[ChatGPT App] [Claude Connector] [Official MCP Registry] [Smithery] [LobeHub] [longbridge-mcp MCP server] [License] [Longbridge]

Official MCP server for the Longbridge brokerage. 164 tools across real-time quotes, options, order routing, fundamentals, analyst ratings, calendars, IPO, price alerts, DCA plans, grid trading, portfolio analytics and community sharelists — covering US and HK markets. Built with Rust using rmcp and axum.

Now live in ChatGPT and Claude

Longbridge is officially listed in the ChatGPT Apps directory and the Claude Connectors directory.
Talk to the markets in plain language — quotes, options, fundamentals, and your own portfolio —
with no config files to edit and no tokens to paste.

Add it in one placeThen just ask
ChatGPTSettings → Apps & Connectors → add Longbridge"How's NVDA trading today?" · "Show my HK positions"
ClaudeSettings → Connectors → add Longbridge (web · desktop · mobile)"Compare AAPL and MSFT valuations" · "Any IPOs this week?"

Sign in once with your Longbridge account. Every request runs over the same hosted, OAuth 2.1–secured endpoint documented below — read-only market data plus full account, portfolio, and trading tools, all gated by your own credentials.

Highlights

  • 164 tools, one endpoint — quotes, options, order routing, fundamentals, analyst research, screeners, IPO, alerts, DCA, grid trading and portfolio analytics across US and HK markets.
  • Stateless by design — every request forwards its Bearer token straight to the Longbridge SDK. No sessions, no database, nothing stored server-side.
  • OAuth 2.1, auto-discovered — RFC 9728 protected-resource and RFC 8414 authorization-server metadata; clients complete the flow with no token to paste.
  • Clean, typed responses — snake_case fields, RFC 3339 timestamps, human-readable symbols, and typed response schemas available as MCP resources.

Built in Rust with rmcp and axum.

Filter tool responses with jq

Every tool accepts an optional _jq string in its arguments. The expression runs on the complete returned JSON, after the normal response serialization. The _jq name is reserved for response filtering to avoid conflicts with business parameters. Usage guidance is sent once in the MCP initialize response's instructions; each tool schema declares only the optional parameter name and type. For example:

json
{  "name": "quote",  "arguments": {    "symbols": ["AAPL.US", "MSFT.US"],    "_jq": "map({symbol, last_done})"  }}

Use .data[:5] to take the first five entries of a data array, .data | map(select(.price > 10)) to select rows, or {total: .total} to project fields. Expressions use the embedded jaq engine's jq-compatible syntax; no separate jq executable is needed.

  • Omit _jq (or pass null) to preserve the original response.
  • One output value is returned directly, multiple values as an array, and no values as []. Scalars and arrays are JSON text; objects also appear in structuredContent, containing only the filtered fields.
  • Plain text responses are available as JSON strings. Multiple content blocks without structured content are available as an array.
  • Tool errors and permission/no-data explanations remain unfiltered.
  • Empty, invalid, or non-string expressions are rejected before the tool runs. If filtering fails at runtime, the response explicitly says the tool already executed. Do not automatically retry writes such as placing an order.
  • Environment access, filesystem imports, and logging filters are unavailable. Output is limited to 10,000 values and 8 MiB; exceeding a limit returns an error rather than a partial result.

Because filters can change the response shape, tools do not advertise a fixed outputSchema. Original typed schemas remain available through resources/list and resources/read at lb://tools/{tool-name}/output-schema for schema-backed tools.

Connect your own client

Longbridge runs a hosted endpoint at https://mcp.longbridge.com — point any MCP client at it and complete OAuth when prompted. Authorization is auto-discovered via RFC 9728; there is no token to paste.

Claude Code

bash
claude mcp add --transport http longbridge https://mcp.longbridge.com

Claude Desktop — add to claude_desktop_config.json, then restart:

json
{ "mcpServers": { "longbridge": { "url": "https://mcp.longbridge.com" } } }

Cursor · Cline · Windsurf · Zed · other clients — point them at https://mcp.longbridge.com with transport streamable-http.

More Claude Code commands
bash
# Local self-hosted instance (see Self-hosting below)claude mcp add --transport http longbridge-local http://localhost:8000/mcp
claude mcp list                  # registered serversclaude mcp get longbridge        # config + auth statusclaude mcp remove longbridge     # unregisterclaude mcp logout longbridge     # re-trigger OAuth after revocation

On first use, the client reads the WWW-Authenticate challenge, fetches /.well-known/oauth-protected-resource (RFC 9728), and opens your browser for the Longbridge OAuth flow. Tokens are cached per session and refreshed automatically.

The 164 tools

Twenty categories spanning market data, trading, research and account management.

CategoryCountCoverage
Quote32Real-time and historical quotes, candlesticks, depth, brokers, options, warrants, watchlists, capital flow, market temperature, short positions, option volume
Fundamental33Financial statements/reports, business segments, institutional views, industry peers/valuation, dividends, EPS forecasts, valuations & valuation comparison, company info/executives, shareholders, corporate actions, operating metrics
Trade15Order submission/cancellation/replacement, multi-leg option combination orders, positions, balance, executions, cash flow, margin
Market15Market status, industry/top-mover rank, broker holdings, A/H premium, trade statistics, anomalies, short trades/margin, index constituents
DCA9Dollar-cost averaging plan create/update/pause/resume/stop, execution history, statistics, support check
Grid11Grid trading order submit/replace/cancel/suspend/restart, list/detail/trigger-history reads, per-symbol setup info, one-time strategy consent
Sharelist8Community sharelist CRUD, member add/remove/sort, popular lists
IPO7IPO subscriptions, calendar, listed stocks, order detail, profit/loss analysis
Content7News list/detail, discussion topic CRUD and replies
Alert5Price alert CRUD (add, delete, enable, disable, list)
Screener5Stock screener search, indicators, strategy recommendation/management
Portfolio4Exchange rates, profit/loss analysis (summary, detail, realized)
ATM3Bank cards, withdrawal records, deposit records
Macrodata2Macroeconomic indicator list and detail
Search2News search, community topic search
Statement2Account statement listing and export
Calendar1Finance calendar (earnings, dividends, IPOs, macro data, closures)
Quant1Run a quant indicator script against historical K-line data
Authenticate1OAuth code exchange for clients that can't complete a browser redirect
Utility1Current UTC time

Self-hosting

Prefer your own instance? Run the published image:

bash
docker run -p 8443:8443 \  -v /path/to/certs:/certs:ro \  ghcr.io/longbridge/longbridge-mcp \  --bind 0.0.0.0:8443 \  --base-url https://mcp.example.com \  --tls-cert /certs/cert.pem \  --tls-key /certs/key.pem

Set --base-url to your externally reachable URL on any public deployment — it is published in the OAuth metadata clients use to discover the authorization server. It defaults to http://localhost:{port}, which remote clients cannot use.

Or build from source: cargo build --release && ./target/release/longbridge-mcp.

Configuration & environment variables

Config lives at ~/.longbridge/mcp/config.json (override the directory with LONGBRIDGE_MCP_CONFIG_DIR). CLI flags take precedence. When tls_cert and tls_key are both set the server runs HTTPS, otherwise HTTP; base_url defaults to https://localhost:{port} with TLS or http://localhost:{port} without.

OptionConfig KeyCLI FlagDefaultDescription
Bind addressbind--bind127.0.0.1:8000HTTP server listen address
Base URLbase_url--base-urlautoPublic base URL for resource metadata
Log directorylog_dir--log-dir(stderr)Directory for rolling log files
TLS certificatetls_cert--tls-cert(none)PEM certificate file for HTTPS
TLS private keytls_key--tls-key(none)PEM private key file for HTTPS
Canary upstreamcanary--canaryfalseTalk to the Longbridge canary environment (*.longbridge.xyz). --canary=false forces production even when the config file enables it

The mainland-China environment (*.longbridge.cn) is not a flag: it is auto-selected when LONGBRIDGE_REGION=cn is set (the same variable the SDK uses), so a mainland cluster needs no dedicated setting.

Upstream endpoints are fixed by the selected environment:

Production (default)Canary (--canary)Mainland (LONGBRIDGE_REGION=cn)
OpenAPIhttps://openapi.longbridge.comhttps://openapi-global.longbridge.xyzhttps://openapi.longbridge.cn
Quote WebSocketwss://openapi-quote.longbridge.com/v2wss://openapi-global-quote.longbridge.xyz/v2wss://openapi-quote.longbridge.cn/v2
Trade WebSocketwss://openapi-trade.longbridge.com/v2wss://openapi-global-trade.longbridge.xyz/v2wss://openapi-trade.longbridge.cn/v2
OAuth / connect pageopenapi.longbridge.com / open.longbridge.comopenapi-global.longbridge.xyz / open.longbridge.xyzopenapi.longbridge.cn / open.longbridge.cn

Canary uses the -global gateway, not openapi.longbridge.xyz: only the former is CloudFront-fronted and performs x-dc-region data-center routing, which this server depends on to serve us_- and ap_-prefixed credentials from one process.

Canary and mainland pin every URL above at startup; production defers to the SDK's own resolution except that a us_ credential with no upstream override is pinned to the global .com gateway. See src/endpoints.rs for the exact selection rules.

Advanced environment variables — most deployments never touch these; they exist for SDK debugging and edge/global-entry deployments.

VariableDefaultDescription
LONGBRIDGE_MCP_CONFIG_DIR~/.longbridge/mcpConfig file directory
LONGBRIDGE_PUBLIC_HOSTS(none)Comma-separated hostnames accepted from the edge-injected X-Host header; matching requests echo that host in the 401 challenge / RFC 9728 metadata. Unset = X-Host ignored
LONGBRIDGE_GLOBAL_OAUTH_URL(none)Authorization-server URL advertised to requests arriving via an allowlisted X-Host (global single-domain entry). Unset = fall back to the mode's OpenAPI base URL
LONGBRIDGE_MCP_QUOTE_WS_IDLE_TTL_SECS600Idle seconds before a cached quote WebSocket context is evicted
LONGBRIDGE_MCP_QUOTE_WS_MAX_CONTEXTS1024Maximum cached quote WebSocket contexts per server process
LONGBRIDGE_MCP_LOG_PAYLOADS(unset)1 lifts the payload log caps (see below). Never set this in production
LONGBRIDGE_LOG_PATH(none)SDK internal log path. Leave unset in production — the SDK writes unfiltered request/response bodies there
Logging & customer data

MCP requests and responses carry customer data — cash balances, positions, order history — and upstream SDK frames carry access tokens. None of it belongs in a log file, so the server caps the log targets that would print it, independent of RUST_LOG:

TargetCapWhat it would otherwise print
longbridge_httpcliwarnOpenAPI request and full response bodies (INFO)
longbridge_wscliwarnEvery WebSocket frame, auth token included (INFO)
longbridge::tradewarnOrder push events (INFO)
rmcpinfoDecoded MCP requests and full tool results (DEBUG), raw JSON-RPC frames (TRACE)

So raising verbosity is safe: RUST_LOG=debug (or trace) gives you the server's own logs without leaking customer data. Two switches defeat this, both off by default — LONGBRIDGE_MCP_LOG_PAYLOADS=1 (removes the caps; use only against a test account locally) and LONGBRIDGE_LOG_PATH (makes the SDK write unfiltered bodies to that directory; the server warns at startup when set).

HTTP endpoints, authentication & metrics

The server expects a Longbridge OAuth access token in Authorization: Bearer <token>. On missing or invalid auth it returns 401 with a WWW-Authenticate header pointing to the protected-resource metadata, which directs clients to the Longbridge OAuth authorization server.

Send x-papertrading: true (or 1) on a request to run it against the paper-trading environment. Upstream rejects a paper-trading request made with a real-money token, so the header is a safety guard rather than a routing switch: it can only narrow what a token may do. LONGBRIDGE_PAPERTRADING=true turns it on for the whole deployment instead.

MethodPathDescription
GET/.well-known/oauth-protected-resourceProtected Resource Metadata (RFC 9728)
GET/.well-known/oauth-authorization-serverAuthorization Server Metadata (RFC 8414); advertises direct Longbridge authorize/register and proxied token/revoke endpoints
POST/oauth2/tokenOAuth token proxy; derives x-dc-region from the code/refresh token, defaulting to AP
POST/oauth2/revokeOAuth revocation proxy; derives x-dc-region from the token, defaulting to AP
GET/metricsPrometheus metrics
POST/GET/DELETE/mcpMCP Streamable HTTP endpoint (requires Bearer token)

Prometheus metrics: mcp_tool_calls_total (counter), mcp_tool_call_duration_seconds (histogram), and mcp_tool_call_errors_total (counter) — each labelled by tool_name.

Development

bash
cargo +nightly fmt      # formatcargo clippy            # lintcargo test              # test

License

Released under the MIT License.

来源：README.md，提交 dfcdc8c

工具

0
该服务器需要登录，因此 SourceWeft 无法在没有账号的情况下读取其工具，也未收录。已连接账号所能看到的内容可能因账号及其权限而异。

版本历史

1
  1. v0.9.0最新Sep 16, 2026

评分

已满足适用检查项的 85%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分