
Longbridge
com.longbridge由 longbridge.com 發布官方發布者v0.9.0更新於 Nov 2, 2026
US/HK markets — 163 tools: quotes, options, orders, fundamentals, screener, IPO, alerts, DCA & grid
概覽
Longbridge 官方券商 MCP 伺服器,透過單一 OAuth 保護端點讓助理取得美股/港股行情、研究、持倉與實盤交易工具。
- 可以做什麼
- 取得即時與歷史行情、K 線、盤口、選擇權、權證、資金流向與自選清單
- 讀取基本面、財務報表、股利、估值、機構觀點、股東與公司行動
- 送出、改單與取消訂單(含多腳選擇權組合單),並檢視持倉、餘額、成交與保證金
- 管理定期定額計畫、網格交易策略、價格提醒、IPO 申購、共享清單與社群話題
- 篩選股票、對 K 線資料執行量化指標腳本,並取得財經日曆、總體資料、新聞與帳戶對帳單
- 以選用的 jq 風格運算式過濾任一工具回傳的 JSON
- 適用情境
- 適合想讓助理回答美股或港股問題、研究公司、檢視 Longbridge 持倉,或在聊天用戶端下單並管理交易與自動化策略的情境。
- 執行需求
- 需要 mcp.longbridge.com 遠端端點(或自架 Docker 映像、Rust 建置)以及 Longbridge 帳戶。認證為 OAuth 2.1,使用 Authorization bearer 權杖並自動探索,無需貼上權杖。自架需 TLS 憑證與可供 OAuth 中繼資料使用的公開 base URL。
安裝
在 SourceWeft 中
- 開啟 儀表板中的 Longbridge,將其新增到工作區。
- 連接 所需的 憑證。它們會被私密儲存,絕不會在公開頁面上展示。
- 為需要使用其工具的對話啟用該服務。
Web executable,透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。
交給代理程式安裝
把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式,或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南,先向你展示發布者、端點和登入方式,經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。
閱讀 https://sourceweft.com/mcp/com.longbridge%2Fmcp/install.md,並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前,先告訴我它的發布者、端點和登入方式,等我確認。不要把 API 金鑰寫進命令或我會提交的檔案;問我金鑰應從哪裡取得。其他 MCP 客戶端
把它新增到你客戶端的 mcpServers 設定中。 客戶端會在首次連接時完成 OAuth 登入。
{
"mcpServers": {
"longbridge": {
"type": "http",
"url": "https://mcp.longbridge.com/"
}
}
}README
Longbridge MCP Server
[ChatGPT App] [Claude Connector] [Official MCP Registry] [Smithery] [LobeHub] [longbridge-mcp MCP server] [License] [Longbridge]
Official MCP server for the Longbridge brokerage. 164 tools across real-time quotes, options, order routing, fundamentals, analyst ratings, calendars, IPO, price alerts, DCA plans, grid trading, portfolio analytics and community sharelists — covering US and HK markets. Built with Rust using rmcp and axum.
Now live in ChatGPT and Claude
Longbridge is officially listed in the ChatGPT Apps directory and the Claude Connectors directory.
Talk to the markets in plain language — quotes, options, fundamentals, and your own portfolio —
with no config files to edit and no tokens to paste.
Sign in once with your Longbridge account. Every request runs over the same hosted, OAuth 2.1–secured endpoint documented below — read-only market data plus full account, portfolio, and trading tools, all gated by your own credentials.
Highlights
- 164 tools, one endpoint — quotes, options, order routing, fundamentals, analyst research, screeners, IPO, alerts, DCA, grid trading and portfolio analytics across US and HK markets.
- Stateless by design — every request forwards its Bearer token straight to the Longbridge SDK. No sessions, no database, nothing stored server-side.
- OAuth 2.1, auto-discovered — RFC 9728 protected-resource and RFC 8414 authorization-server metadata; clients complete the flow with no token to paste.
- Clean, typed responses — snake_case fields, RFC 3339 timestamps, human-readable symbols, and typed response schemas available as MCP resources.
Built in Rust with rmcp and axum.
Filter tool responses with jq
Every tool accepts an optional _jq string in its arguments. The expression runs
on the complete returned JSON, after the normal response serialization. The _jq
name is reserved for response filtering to avoid conflicts with business parameters.
Usage guidance is sent once in the MCP initialize response's instructions;
each tool schema declares only the optional parameter name and type.
For example:
Use .data[:5] to take the first five entries of a data array,
.data | map(select(.price > 10)) to select rows, or {total: .total} to
project fields. Expressions use the embedded jaq
engine's jq-compatible syntax; no separate jq executable is needed.
- Omit
_jq(or passnull) to preserve the original response. - One output value is returned directly, multiple values as an array, and no
values as
[]. Scalars and arrays are JSON text; objects also appear instructuredContent, containing only the filtered fields. - Plain text responses are available as JSON strings. Multiple content blocks without structured content are available as an array.
- Tool errors and permission/no-data explanations remain unfiltered.
- Empty, invalid, or non-string expressions are rejected before the tool runs. If filtering fails at runtime, the response explicitly says the tool already executed. Do not automatically retry writes such as placing an order.
- Environment access, filesystem imports, and logging filters are unavailable. Output is limited to 10,000 values and 8 MiB; exceeding a limit returns an error rather than a partial result.
Because filters can change the response shape, tools do not advertise a fixed
outputSchema. Original typed schemas remain available through resources/list
and resources/read at lb://tools/{tool-name}/output-schema for schema-backed tools.
Connect your own client
Longbridge runs a hosted endpoint at https://mcp.longbridge.com — point any MCP client at it and complete OAuth when prompted. Authorization is auto-discovered via RFC 9728; there is no token to paste.
Claude Code
Claude Desktop — add to claude_desktop_config.json, then restart:
Cursor · Cline · Windsurf · Zed · other clients — point them at https://mcp.longbridge.com with transport streamable-http.
More Claude Code commands
On first use, the client reads the WWW-Authenticate challenge, fetches /.well-known/oauth-protected-resource (RFC 9728), and opens your browser for the Longbridge OAuth flow. Tokens are cached per session and refreshed automatically.
The 164 tools
Twenty categories spanning market data, trading, research and account management.
Self-hosting
Prefer your own instance? Run the published image:
Set
--base-urlto your externally reachable URL on any public deployment — it is published in the OAuth metadata clients use to discover the authorization server. It defaults tohttp://localhost:{port}, which remote clients cannot use.
Or build from source: cargo build --release && ./target/release/longbridge-mcp.
Configuration & environment variables
Config lives at ~/.longbridge/mcp/config.json (override the directory with LONGBRIDGE_MCP_CONFIG_DIR). CLI flags take precedence. When tls_cert and tls_key are both set the server runs HTTPS, otherwise HTTP; base_url defaults to https://localhost:{port} with TLS or http://localhost:{port} without.
The mainland-China environment (*.longbridge.cn) is not a flag: it is auto-selected when LONGBRIDGE_REGION=cn is set (the same variable the SDK uses), so a mainland cluster needs no dedicated setting.
Upstream endpoints are fixed by the selected environment:
Canary uses the -global gateway, not openapi.longbridge.xyz: only the former is CloudFront-fronted and performs x-dc-region data-center routing, which this server depends on to serve us_- and ap_-prefixed credentials from one process.
Canary and mainland pin every URL above at startup; production defers to the SDK's own resolution except that a us_ credential with no upstream override is pinned to the global .com gateway. See src/endpoints.rs for the exact selection rules.
Advanced environment variables — most deployments never touch these; they exist for SDK debugging and edge/global-entry deployments.
Logging & customer data
MCP requests and responses carry customer data — cash balances, positions, order history — and upstream SDK frames carry access tokens. None of it belongs in a log file, so the server caps the log targets that would print it, independent of RUST_LOG:
So raising verbosity is safe: RUST_LOG=debug (or trace) gives you the server's own logs without leaking customer data. Two switches defeat this, both off by default — LONGBRIDGE_MCP_LOG_PAYLOADS=1 (removes the caps; use only against a test account locally) and LONGBRIDGE_LOG_PATH (makes the SDK write unfiltered bodies to that directory; the server warns at startup when set).
HTTP endpoints, authentication & metrics
The server expects a Longbridge OAuth access token in Authorization: Bearer <token>. On missing or invalid auth it returns 401 with a WWW-Authenticate header pointing to the protected-resource metadata, which directs clients to the Longbridge OAuth authorization server.
Send x-papertrading: true (or 1) on a request to run it against the paper-trading environment. Upstream rejects a paper-trading request made with a real-money token, so the header is a safety guard rather than a routing switch: it can only narrow what a token may do. LONGBRIDGE_PAPERTRADING=true turns it on for the whole deployment instead.
Prometheus metrics: mcp_tool_calls_total (counter), mcp_tool_call_duration_seconds (histogram), and mcp_tool_call_errors_total (counter) — each labelled by tool_name.
Development
License
Released under the MIT License.
來源:README.md,提交 dfcdc8c
工具
0版本歷史
1- v0.9.0最新Sep 16, 2026
評分
已滿足適用檢查項的 85%
該評分衡量此收錄條目的完整程度,依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價,也不表示伺服器安全或目前可用:可連通性是帶日期的檢查結果,評分也不包含安裝量或使用者評價。
- 近 30 天內可連通必需25 分
- 已宣告認證方式必需10 分
- 已列出工具15 分
請讓伺服器在無憑證時回應 tools/list,或發布可在沙箱中無憑證啟動的軟體包。
- 描述必需15 分
- 圖示10 分
- 文件15 分
- 授權條款10 分