Alpaca MCP Server

Findings (17)

• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  network issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  dnspython@2.8.0: 1 known vulnerability

  GHSA-45c3-73f7-pv4m

  uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  mcp@1.26.0: 7 known vulnerabilities

  PYSEC-2026-3481, PYSEC-2026-3482, PYSEC-2026-3483, GHSA-5h93-6whr-6q8j, GHSA-84m7-p3x7-pcfv +2 more

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  fastmcp@3.4.7: 1 known vulnerability

  GHSA-7xgj-8392-5q4r

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  fastmcp-slim@3.4.7: 1 known vulnerability

  GHSA-7xgj-8392-5q4r

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  idna@3.11: 1 known vulnerability

  PYSEC-2026-215

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  opentelemetry-api@1.40.0: 1 known vulnerability

  GHSA-xcq7-p3pf-p88h

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  pydantic-settings@2.12.0: 1 known vulnerability

  GHSA-4xgf-cpjx-pc3j

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  pygments@2.19.2: 1 known vulnerability

  PYSEC-2026-2987

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  pytest@9.0.2: 1 known vulnerability

  PYSEC-2026-1845

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  python-dotenv@1.2.1: 1 known vulnerability

  PYSEC-2026-2270

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  Reads environment variables not listed in the manifest

  ALPACA_MCP_USER_AGENT, ALPACA_PAPER_TRADE, DATA_API_URL

Network activity

Tools exposed (5)

• search_alpaca_docs

  Search Alpaca documentation pages and guides. Use for conceptual or product questions about setup, account rules, funding, trading, market data, events, or FAQs. Read-only; not for exact API method/path lookup; prefer search_alpaca_api_specs for endpoint, parameter, or schema questions.

• fetch_alpaca_doc

  Fetch one Alpaca ReadMe documentation page by page ID. Use after search_alpaca_docs returns a relevant page ID, or when a page ID is already known. Read-only; not for API endpoint lookup by method and path.

• search_alpaca_api_specs

  Search Alpaca API reference endpoints by topic, operation, path fragment, parameter, or schema term. Use when the exact method and path are unknown. Read-only; does not execute endpoints; searches Trading API, Market Data API, and Authentication API only; excludes Broker API. Use `query`; do not use

• list_alpaca_api_endpoints

  List endpoints for one allowed Alpaca OpenAPI spec. Use when browsing the available endpoint inventory for Trading API, Market Data API, or Authentication API before narrowing to a specific endpoint. Read-only; excludes Broker API; prefer search_alpaca_api_specs for targeted lookup.

• get_alpaca_endpoint_docs

  Fetch reference docs for one exact Alpaca API endpoint by method and path. Use when the endpoint is already resolved and details such as parameters, request shape, responses, or examples are needed. Read-only; does not execute the endpoint; excludes Broker API.