
Longbridge MCP Server
MCP长桥证券官方 MCP,覆盖港美股实时行情、期权、基本面、分析师评级、选股、IPO、定投与下单交易等 160 余个工具。提供托管远程端点,需用长桥账户 OAuth 登录。
Longbridge MCP Server
Official MCP server for the Longbridge brokerage. 164 tools across real-time quotes, options, order routing, fundamentals, analyst ratings, calendars, IPO, price alerts, DCA plans, grid trading, portfolio analytics and community sharelists — covering US and HK markets. Built with Rust using rmcp and axum.
Now live in ChatGPT and Claude
Longbridge is officially listed in the ChatGPT Apps directory and the Claude Connectors directory.
Talk to the markets in plain language — quotes, options, fundamentals, and your own portfolio —
with no config files to edit and no tokens to paste.
| Add it in one place | Then just ask | |
|---|---|---|
| ChatGPT | Settings → Apps & Connectors → add Longbridge | "How's NVDA trading today?" · "Show my HK positions" |
| Claude | Settings → Connectors → add Longbridge (web · desktop · mobile) | "Compare AAPL and MSFT valuations" · "Any IPOs this week?" |
Sign in once with your Longbridge account. Every request runs over the same hosted, OAuth 2.1–secured endpoint documented below — read-only market data plus full account, portfolio, and trading tools, all gated by your own credentials.
Highlights
- 164 tools, one endpoint — quotes, options, order routing, fundamentals, analyst research, screeners, IPO, alerts, DCA, grid trading and portfolio analytics across US and HK markets.
- Stateless by design — every request forwards its Bearer token straight to the Longbridge SDK. No sessions, no database, nothing stored server-side.
- OAuth 2.1, auto-discovered — RFC 9728 protected-resource and RFC 8414 authorization-server metadata; clients complete the flow with no token to paste.
- Clean, typed responses — snake_case fields, RFC 3339 timestamps, human-readable symbols, and typed response schemas available as MCP resources.
Built in Rust with rmcp and axum.
Filter tool responses with jq
Every tool accepts an optional _jq string in its arguments. The expression runs
on the complete returned JSON, after the normal response serialization. The _jq
name is reserved for response filtering to avoid conflicts with business parameters.
Usage guidance is sent once in the MCP initialize response's instructions;
each tool schema declares only the optional parameter name and type.
For example:
{
"name": "quote",
"arguments": {
"symbols": ["AAPL.US", "MSFT.US"],
"_jq": "map({symbol, last_done})"
}
}
Use .data[:5] to take the first five entries of a data array,
.data | map(select(.price > 10)) to select rows, or {total: .total} to
project fields. Expressions use the embedded jaq
engine's jq-compatible syntax; no separate jq executable is needed.
- Omit
_jq(or passnull) to preserve the original response. - One output value is returned directly, multiple values as an array, and no
values as
[]. Scalars and arrays are JSON text; objects also appear instructuredContent, containing only the filtered fields. - Plain text responses are available as JSON strings. Multiple content blocks without structured content are available as an array.
- Tool errors and permission/no-data explanations remain unfiltered.
- Empty, invalid, or non-string expressions are rejected before the tool runs. If filtering fails at runtime, the response explicitly says the tool already executed. Do not automatically retry writes such as placing an order.
- Environment access, filesystem imports, and logging filters are unavailable. Output is limited to 10,000 values and 8 MiB; exceeding a limit returns an error rather than a partial result.
Because filters can change the response shape, tools do not advertise a fixed
outputSchema. Original typed schemas remain available through resources/list
and resources/read at lb://tools/{tool-name}/output-schema for schema-backed tools.
Connect your own client
Longbridge runs a hosted endpoint at https://mcp.longbridge.com — point any MCP client at it and complete OAuth when prompted. Authorization is auto-discovered via RFC 9728; there is no token to paste.
Claude Code
claude mcp add --transport http longbridge https://mcp.longbridge.com
Claude Desktop — add to claude_desktop_config.json, then restart:
{ "mcpServers": { "longbridge": { "url": "https://mcp.longbridge.com" } } }
Cursor · Cline · Windsurf · Zed · other clients — point them at https://mcp.longbridge.com with transport streamable-http.
More Claude Code commands
# Local self-hosted instance (see Self-hosting below)
claude mcp add --transport http longbridge-local http://localhost:8000/mcp
claude mcp list # registered servers
claude mcp get longbridge # config + auth status
claude mcp remove longbridge # unregister
claude mcp logout longbridge # re-trigger OAuth after revocation
On first use, the client reads the WWW-Authenticate challenge, fetches /.well-known/oauth-protected-resource (RFC 9728), and opens your browser for the Longbridge OAuth flow. Tokens are cached per session and refreshed automatically.
The 164 tools
Twenty categories spanning market data, trading, research and account management.
| Category | Count | Coverage |
|---|---|---|
| Quote | 32 | Real-time and historical quotes, candlesticks, depth, brokers, options, warrants, watchlists, capital flow, market temperature, short positions, option volume |
| Fundamental | 33 | Financial statements/reports, business segments, institutional views, industry peers/valuation, dividends, EPS forecasts, valuations & valuation comparison, company info/executives, shareholders, corporate actions, operating metrics |
| Trade | 15 | Order submission/cancellation/replacement, multi-leg option combination orders, positions, balance, executions, cash flow, margin |
| Market | 15 | Market status, industry/top-mover rank, broker holdings, A/H premium, trade statistics, anomalies, short trades/margin, index constituents |
| DCA | 9 | Dollar-cost averaging plan create/update/pause/resume/stop, execution history, statistics, support check |
| Grid | 11 | Grid trading order submit/replace/cancel/suspend/restart, list/detail/trigger-history reads, per-symbol setup info, one-time strategy consent |
| Sharelist | 8 | Community sharelist CRUD, member add/remove/sort, popular lists |
| IPO | 7 | IPO subscriptions, calendar, listed stocks, order detail, profit/loss analysis |
| Content | 7 | News list/detail, discussion topic CRUD and replies |
| Alert | 5 | Price alert CRUD (add, delete, enable, disable, list) |
| Screener | 5 | Stock screener search, indicators, strategy recommendation/management |
| Portfolio | 4 | Exchange rates, profit/loss analysis (summary, detail, realized) |
| ATM | 3 | Bank cards, withdrawal records, deposit records |
| Macrodata | 2 | Macroeconomic indicator list and detail |
| Search | 2 | News search, community topic search |
| Statement | 2 | Account statement listing and export |
| Calendar | 1 | Finance calendar (earnings, dividends, IPOs, macro data, closures) |
| Quant | 1 | Run a quant indicator script against historical K-line data |
| Authenticate | 1 | OAuth code exchange for clients that can't complete a browser redirect |
| Utility | 1 | Current UTC time |
Self-hosting
Prefer your own instance? Run the published image:
docker run -p 8443:8443 \
-v /path/to/certs:/certs:ro \
ghcr.io/longbridge/longbridge-mcp \
--bind 0.0.0.0:8443 \
--base-url https://mcp.example.com \
--tls-cert /certs/cert.pem \
--tls-key /certs/key.pem
Set
--base-urlto your externally reachable URL on any public deployment — it is published in the OAuth metadata clients use to discover the authorization server. It defaults tohttp://localhost:{port}, which remote clients cannot use.
Or build from source: cargo build --release && ./target/release/longbridge-mcp.
Configuration & environment variables
Config lives at ~/.longbridge/mcp/config.json (override the directory with LONGBRIDGE_MCP_CONFIG_DIR). CLI flags take precedence. When tls_cert and tls_key are both set the server runs HTTPS, otherwise HTTP; base_url defaults to https://localhost:{port} with TLS or http://localhost:{port} without.
| Option | Config Key | CLI Flag | Default | Description |
|---|---|---|---|---|
| Bind address | bind | --bind | 127.0.0.1:8000 | HTTP server listen address |
| Base URL | base_url | --base-url | auto | Public base URL for resource metadata |
| Log directory | log_dir | --log-dir | (stderr) | Directory for rolling log files |
| TLS certificate | tls_cert | --tls-cert | (none) | PEM certificate file for HTTPS |
| TLS private key | tls_key | --tls-key | (none) | PEM private key file for HTTPS |
| Canary upstream | canary | --canary | false | Talk to the Longbridge canary environment (*.longbridge.xyz). --canary=false forces production even when the config file enables it |
The mainland-China environment (*.longbridge.cn) is not a flag: it is auto-selected when LONGBRIDGE_REGION=cn is set (the same variable the SDK uses), so a mainland cluster needs no dedicated setting.
Upstream endpoints are fixed by the selected environment:
| Production (default) | Canary (--canary) | Mainland (LONGBRIDGE_REGION=cn) | |
|---|---|---|---|
| OpenAPI | https://openapi.longbridge.com | https://openapi-global.longbridge.xyz | https://openapi.longbridge.cn |
| Quote WebSocket | wss://openapi-quote.longbridge.com/v2 | wss://openapi-global-quote.longbridge.xyz/v2 | wss://openapi-quote.longbridge.cn/v2 |
| Trade WebSocket | wss://openapi-trade.longbridge.com/v2 | wss://openapi-global-trade.longbridge.xyz/v2 | wss://openapi-trade.longbridge.cn/v2 |
| OAuth / connect page | openapi.longbridge.com / open.longbridge.com | openapi-global.longbridge.xyz / open.longbridge.xyz | openapi.longbridge.cn / open.longbridge.cn |
Canary uses the -global gateway, not openapi.longbridge.xyz: only the former is CloudFront-fronted and performs x-dc-region data-center routing, which this server depends on to serve us_- and ap_-prefixed credentials from one process.
Canary and mainland pin every URL above at startup; production defers to the SDK's own resolution except that a us_ credential with no upstream override is pinned to the global .com gateway. See src/endpoints.rs for the exact selection rules.
Advanced environment variables — most deployments never touch these; they exist for SDK debugging and edge/global-entry deployments.
| Variable | Default | Description |
|---|---|---|
LONGBRIDGE_MCP_CONFIG_DIR | ~/.longbridge/mcp | Config file directory |
LONGBRIDGE_PUBLIC_HOSTS | (none) | Comma-separated hostnames accepted from the edge-injected X-Host header; matching requests echo that host in the 401 challenge / RFC 9728 metadata. Unset = X-Host ignored |
LONGBRIDGE_GLOBAL_OAUTH_URL | (none) | Authorization-server URL advertised to requests arriving via an allowlisted X-Host (global single-domain entry). Unset = fall back to the mode's OpenAPI base URL |
LONGBRIDGE_MCP_QUOTE_WS_IDLE_TTL_SECS | 600 | Idle seconds before a cached quote WebSocket context is evicted |
LONGBRIDGE_MCP_QUOTE_WS_MAX_CONTEXTS | 1024 | Maximum cached quote WebSocket contexts per server process |
LONGBRIDGE_MCP_LOG_PAYLOADS | (unset) | 1 lifts the payload log caps (see below). Never set this in production |
LONGBRIDGE_LOG_PATH | (none) | SDK internal log path. Leave unset in production — the SDK writes unfiltered request/response bodies there |
Logging & customer data
MCP requests and responses carry customer data — cash balances, positions, order history — and upstream SDK frames carry access tokens. None of it belongs in a log file, so the server caps the log targets that would print it, independent of RUST_LOG:
| Target | Cap | What it would otherwise print |
|---|---|---|
longbridge_httpcli | warn | OpenAPI request and full response bodies (INFO) |
longbridge_wscli | warn | Every WebSocket frame, auth token included (INFO) |
longbridge::trade | warn | Order push events (INFO) |
rmcp | info | Decoded MCP requests and full tool results (DEBUG), raw JSON-RPC frames (TRACE) |
So raising verbosity is safe: RUST_LOG=debug (or trace) gives you the server's own logs without leaking customer data. Two switches defeat this, both off by default — LONGBRIDGE_MCP_LOG_PAYLOADS=1 (removes the caps; use only against a test account locally) and LONGBRIDGE_LOG_PATH (makes the SDK write unfiltered bodies to that directory; the server warns at startup when set).
HTTP endpoints, authentication & metrics
The server expects a Longbridge OAuth access token in Authorization: Bearer <token>. On missing or invalid auth it returns 401 with a WWW-Authenticate header pointing to the protected-resource metadata, which directs clients to the Longbridge OAuth authorization server.
Send x-papertrading: true (or 1) on a request to run it against the paper-trading environment. Upstream rejects a paper-trading request made with a real-money token, so the header is a safety guard rather than a routing switch: it can only narrow what a token may do. LONGBRIDGE_PAPERTRADING=true turns it on for the whole deployment instead.
| Method | Path | Description |
|---|---|---|
| GET | /.well-known/oauth-protected-resource | Protected Resource Metadata (RFC 9728) |
| GET | /.well-known/oauth-authorization-server | Authorization Server Metadata (RFC 8414); advertises direct Longbridge authorize/register and proxied token/revoke endpoints |
| POST | /oauth2/token | OAuth token proxy; derives x-dc-region from the code/refresh token, defaulting to AP |
| POST | /oauth2/revoke | OAuth revocation proxy; derives x-dc-region from the token, defaulting to AP |
| GET | /metrics | Prometheus metrics |
| POST/GET/DELETE | /mcp | MCP Streamable HTTP endpoint (requires Bearer token) |
Prometheus metrics: mcp_tool_calls_total (counter), mcp_tool_call_duration_seconds (histogram), and mcp_tool_call_errors_total (counter) — each labelled by tool_name.
Development
cargo +nightly fmt # format
cargo clippy # lint
cargo test # test
License
Released under the MIT License.
相关资源

Longbridge Terminal
CLI长桥证券官方命令行,可查港美股实时行情、K 线、期权与窝轮、个股新闻与公告、账户持仓与资金,也能下单(默认只预览,确认后才执行);命令都能输出 JSON,便于 agent 整理投研材料。需长桥证券账户并在浏览器登录授权;分析结论需专业人员复核。
longbridge/longbridge-terminal1k
Vibe-Trading
MCP港大 HKUDS 开源的交易研究 agent,MCP 服务有 70 余个工具,覆盖 A 股、港美股与加密货币的行情、财报、回测和投研分析。需本地装 Python,港美股与加密研究免 API Key;结果仅供研究,投资决策需专业人员复核。
HKUDS/Vibe-Trading35.6k
MaverickMCP
MCP面向个人投资者的股票分析 MCP:基于 yfinance 提供行情、RSI/MACD 等技术指标、选股策略、持仓与交易日志,核心工具无需 API Key;可选装回测与深度研究扩展。
wshobson/maverick-mcp704
Longbridge Skills
Plugin长桥证券官方技能插件:用中文或英文提问,即可查询港美 A 股与新加坡市场的行情、技术面与衍生品、财报与估值、分析师评级、自选股和个人持仓,并生成财报复盘与晨间简报。需要长桥账号并安装长桥命令行或接入长桥 MCP;输出不构成投资建议,需专业人员复核。
longbridge/skills64
Massive.com MCP Server
MCPMassive(原 Polygon.io)官方 MCP,用搜索、调用、SQL 查询三个工具覆盖美股、期权、外汇、加密货币与期货的行情和基本面数据,内置期权希腊值与收益率计算。需要 API Key,项目仍处实验阶段。
massive-com/mcp_massive398
Alpha Vantage MCP Server
MCP把 Alpha Vantage 接口直接暴露为 MCP 工具:股票与期权行情、基本面、新闻情绪、外汇、加密货币、大宗商品、经济指标与数十种技术指标。官方维护,需免费 API Key,另有 OAuth 远程服务。
alphavantage/alpha_vantage_mcp221