LangAlpha MCP Server

by ginlix-ai• 2.2k•• Scanned•Claim this listing•Request removal
Finance & Tradingagentinvestmentlangchainlangraphllm

Claude Code for Financial Market

LangAlpha is an open-source mcp server by ginlix-ai, written mainly in Python, with 2,224 GitHub stars and the Apache-2.0 license. Its code was last updated Nov 1, 2026.

Scan summary: scanned Nov 5, 2026 at commit b5e3ec2. Seen able to run dynamic code, read environment and secrets, connect to the internet. Scan policy

aboutREADMEsecurityreviews
Scanned
Full scan at b5e3ec2 · Nov 5, 2026
Scanned Builds
Static code scanwarn
Secrets scanfail
Dependency audit319 known vulnerabilitiesfail
Manifestnonewarn
Buildpass
Boot & handshakefail
Network egresswarn
Reproducible (×3)n/a

Findings (136)

  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • medium
    @xmldom/xmldom@0.8.14: 8 known vulnerabilities
    GHSA-27p8-2357-5qqv, GHSA-6gmq-8vp8-gcm6, GHSA-6h8r-xr42-gp59, GHSA-8344-3jmq-59r6, GHSA-93r5-fhx6-vmg9 +3 more
    desktop/pnpm-lock.yaml
  • medium
    @xmldom/xmldom@0.9.11: 11 known vulnerabilities
    GHSA-27p8-2357-5qqv, GHSA-3px3-54cx-rmw9, GHSA-6gmq-8vp8-gcm6, GHSA-6h8r-xr42-gp59, GHSA-6mj3-qw4j-hgrw +6 more
    desktop/pnpm-lock.yaml
  • medium
    app-builder-lib@25.1.8: 1 known vulnerability
    GHSA-7g7r-gx96-252g
    desktop/pnpm-lock.yaml
  • medium
    brace-expansion@1.1.18: 3 known vulnerabilities
    GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7
    desktop/pnpm-lock.yaml
  • medium
    brace-expansion@2.1.4: 3 known vulnerabilities
    GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7
    desktop/pnpm-lock.yaml
  • medium
    brace-expansion@5.0.9: 3 known vulnerabilities
    GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7
    desktop/pnpm-lock.yaml
  • medium
    builder-util-runtime@9.2.10: 1 known vulnerability
    GHSA-p2f4-r6v6-j797
    desktop/pnpm-lock.yaml
  • medium
    electron@43.4.0: 12 known vulnerabilities
    GHSA-2p8c-gr87-2676, GHSA-3qxv-5xgr-q7w9, GHSA-98mx-cjp9-gchm, GHSA-997q-gvvc-jwmx, GHSA-9qh4-3jw8-366w +7 more
    desktop/pnpm-lock.yaml
  • medium
    fast-uri@3.1.5: 10 known vulnerabilities
    GHSA-333x-w4r6-6crp, GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-hrr3-gc8f-f4qj +5 more
    desktop/pnpm-lock.yaml
  • medium
    js-yaml@4.3.1: 1 known vulnerability
    GHSA-2883-xcg3-v3hh
    desktop/pnpm-lock.yaml
  • medium
    sharp@0.33.5: 3 known vulnerabilities
    GHSA-f88m-g3jw-g9cj, GHSA-rgj7-g3m4-5g8c, GHSA-wq5f-xc86-pv6w
    desktop/pnpm-lock.yaml
  • medium
    undici@6.28.0: 8 known vulnerabilities
    GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-4qv8-2p9j-2685, GHSA-9fm3-97px-rjf6, GHSA-qrxm-fqhp-jwvm +3 more
    desktop/pnpm-lock.yaml
  • medium
    undici@7.29.0: 18 known vulnerabilities
    GHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-3xpg-4rpp-hhhm +13 more
    desktop/pnpm-lock.yaml
  • medium
    russh@0.64.1: 4 known vulnerabilities
    GHSA-4p9f-7p9m-5vfg, GHSA-9wfm-jcj8-jfv9, GHSA-fw5c-8223-6h42, GHSA-vp5q-ff62-jwqv
    helper/Cargo.lock
  • medium
    aiohttp@3.14.3: 8 known vulnerabilities
    GHSA-2g87-pp6c-29x5, GHSA-494j-54xm-rwp3, GHSA-5wr8-gcqf-gqf3, GHSA-6cjc-53gc-5rqm, GHSA-9xw5-w5jj-pvcg +3 more
    uv.lock
  • medium
    black@26.5.1: 1 known vulnerability
    GHSA-cg8m-r9f2-5wm2
    uv.lock
  • medium
    cryptography@48.0.1: 3 known vulnerabilities
    PYSEC-2026-3552, PYSEC-2026-3553, PYSEC-2026-3554
    uv.lock
  • medium
    dnspython@2.8.0: 1 known vulnerability
    GHSA-45c3-73f7-pv4m
    uv.lock
  • medium
    filelock@3.29.0: 9 known vulnerabilities
    GHSA-567q-5qvw-pf92, GHSA-69hj-f68j-2879, GHSA-8mx5-7m5m-r77g, GHSA-9vhv-jxww-xfm5, GHSA-cwqr-hh33-gh44 +4 more
    uv.lock
  • medium
    httpcore2@2.9.1: 1 known vulnerability
    PYSEC-2026-3844
    uv.lock
  • medium
    httpx2@2.9.1: 5 known vulnerabilities
    PYSEC-2026-3845, PYSEC-2026-3846, PYSEC-2026-3847, PYSEC-2026-3848, PYSEC-2026-3849
    uv.lock
  • medium
    json-repair@0.53.1: 1 known vulnerability
    GHSA-xf7x-x43h-rpqh
    uv.lock
  • medium
    langgraph-api@0.10.3: 1 known vulnerability
    GHSA-4hm6-w6qq-w73v
    uv.lock
  • medium
    mcp@2.0.0: 4 known vulnerabilities
    GHSA-5h93-6whr-6q8j, GHSA-84m7-p3x7-pcfv, GHSA-rwrf-2pqf-9j8j, GHSA-w4fh-qvv9-3v23
    uv.lock
  • medium
    protego@0.6.0: 1 known vulnerability
    PYSEC-2026-3906
    uv.lock
  • medium
    pyasn1@0.6.3: 7 known vulnerabilities
    PYSEC-2026-3455, PYSEC-2026-3456, PYSEC-2026-3457, GHSA-2qm8-x737-gmw5, GHSA-9m75-vc3g-4x39 +2 more
    uv.lock
  • medium
    pypdf@6.12.1: 42 known vulnerabilities
    PYSEC-2026-3009, PYSEC-2026-3010, PYSEC-2026-3018, PYSEC-2026-3020, PYSEC-2026-3022 +37 more
    uv.lock
  • medium
    soupsieve@2.8.3: 4 known vulnerabilities
    PYSEC-2026-3071, PYSEC-2026-3072, PYSEC-2026-4170, PYSEC-2026-4171
    uv.lock
  • medium
    starlette@1.1.0: 2 known vulnerabilities
    PYSEC-2026-248, PYSEC-2026-249
    uv.lock
  • medium
    urllib3@2.7.0: 3 known vulnerabilities
    PYSEC-2026-4175, PYSEC-2026-4176, PYSEC-2026-4177
    uv.lock
  • medium
    source-map-js@1.2.1: 1 known vulnerability
    GHSA-68fv-2mgg-jv7q
    web/pnpm-lock.yaml
  • medium
    undici@8.11.2: 8 known vulnerabilities
    GHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-4w7w-5xrc-9h26, GHSA-55wc-3pg8-jfw6, GHSA-9fm3-97px-rjf6 +3 more
    web/pnpm-lock.yaml
  • medium
    uuid@8.3.2: 1 known vulnerability
    GHSA-w5hq-g745-h8pq
    web/pnpm-lock.yaml
  • medium
    vite@8.3.1: 6 known vulnerabilities
    GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22 +1 more
    web/pnpm-lock.yaml
  • medium
    zod@4.6.5: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    web/pnpm-lock.yaml
  • medium
    Install contacted hosts other than package registries
    releases.astral.sh
  • medium
    MCP server didn't complete the protocol handshake
    server exited early with code 127
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    src/server/preview_proxy/bridge/bridge.test.ts:1288
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    web/e2e/chat-follow.spec.js:158
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    web/e2e/chat-follow.spec.js:298
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    web/e2e/chat-follow.spec.js:319
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    web/e2e/handoff-answer.spec.js:272
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    web/e2e/helpers/frameProbe.js:17
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    web/src/pages/ChatAgent/components/__tests__/ComputersDialog.remoteControl.test.tsx:284
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    web/src/pages/ChatAgent/components/__tests__/ComputersDialog.remoteControl.test.tsx:367
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    web/src/pages/ChatAgent/components/__tests__/ComputersDialog.startFailure.test.tsx:316
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    web/src/pages/ChatAgent/components/__tests__/ComputersDialog.test.tsx:746
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    web/src/pages/ChatAgent/components/__tests__/ComputersDialog.test.tsx:790
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    web/src/pages/ChatAgent/components/__tests__/ComputersDialog.test.tsx:793
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    web/src/pages/ChatAgent/components/__tests__/ComputersDialog.test.tsx:797
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    web/src/pages/ChatAgent/components/__tests__/remoteControlSetup.test.tsx:66
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    web/src/pages/ChatAgent/components/__tests__/sshSetup.test.tsx:61
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    web/src/pages/ChatAgent/components/__tests__/sshSetup.test.tsx:109
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    web/src/pages/ChatAgent/components/__tests__/sshSetup.test.tsx:417
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    web/src/pages/ChatAgent/components/__tests__/sshTarget.test.ts:39
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    web/src/pages/ChatAgent/components/mcp/__tests__/McpServerModal.test.tsx:768
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    web/src/pages/ChatAgent/components/mcp/__tests__/mcpSchemas.test.ts:141
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    web/src/pages/ChatAgent/components/mcp/__tests__/mcpSchemas.test.ts:156
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    web/src/pages/ChatAgent/components/mcp/__tests__/mcpServerDraft.test.ts:288
  • low
    Possible example credential in docs/tests: generic-api-key
    desktop/test/remote-control.test.js:25
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/integration/sandbox/api/test_secret_redaction.py:23
  • low
    Possible example credential in docs/tests: generic-api-key
    5 matches in this file
    tests/unit/middleware/test_leak_detection_middleware.py:47
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/ptc_agent/agent/middleware/provenance/test_provenance_body_hash_stability.py:247
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    tests/unit/server/app/test_api_keys.py:327
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/server/app/test_public_redaction.py:27
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/server/app/test_threads_fork_turn.py:331
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/server/app/test_threads_steered_duplicate.py:24
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    tests/unit/server/app/test_memo_api.py:75
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/server/handlers/chat/test_handle_workflow_error.py:471
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    tests/unit/server/database/test_provenance_bodies.py:523
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/server/models/test_chat_models.py:440
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/server/services/history/test_projector.py:831
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/server/services/runs/test_pending_input.py:94
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/server/handlers/chat/test_admission_gate.py:30
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    tests/unit/server/services/history/test_replay.py:920
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    tests/unit/server/handlers/test_streaming_handler.py:1603
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/server/app/test_egress_relay.py:2048
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    tests/unit/server/services/test_mcp_import.py:227
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    tests/unit/server/services/test_mcp_command_check.py:422
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/server/services/test_mcp_probe_errors.py:96
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/server/services/test_plugin_update_reconcile.py:33
  • low
    Possible example credential in docs/tests: stripe-access-token
    tests/unit/server/services/test_mcp_probe_verdict.py:622
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/server/services/test_mcp_probe_verdict.py:606
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/server/services/test_egress_session_binding.py:50
  • low
    Possible example credential in docs/tests: generic-api-key
    4 matches in this file
    tests/unit/server/utils/test_secret_redactor.py:40
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/server/services/test_plugin_conformance.py:302
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/server/services/test_livefs_mount.py:332
  • low
    Possible example credential in docs/tests: generic-api-key
    web/src/pages/ChatAgent/components/mcp/__tests__/mcpHeadersFingerprint.test.ts:5
  • low
    Possible example credential in docs/tests: generic-api-key
    web/src/pages/ChatAgent/components/mcp/__tests__/McpServerModal.test.tsx:362
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    tests/unit/server/services/test_mcp_oauth_lifecycle.py:1971
  • low
    @vitest/mocker@3.2.7: 2 known vulnerabilities
    GHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8
    cli/pnpm-lock.yaml
  • low
    vitest@3.2.7: 1 known vulnerability
    GHSA-82fw-gwwq-j7x9
    cli/pnpm-lock.yaml
  • low
    glob@10.5.0: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    desktop/pnpm-lock.yaml
  • low
    ip-address@10.5.0: 5 known vulnerabilities
    GHSA-2vr4-cq9g-pvrc, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5
    desktop/pnpm-lock.yaml
  • low
    minimatch@10.2.6: 2 known vulnerabilities
    GHSA-g3hv-75wg-m249, GHSA-g3hv-75wg-m249
    desktop/pnpm-lock.yaml
  • low
    minimatch@9.0.9: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    desktop/pnpm-lock.yaml
  • low
    crypto-bigint@0.7.5: 1 known vulnerability
    RUSTSEC-2026-0387
    helper/Cargo.lock
  • low
    pageant@0.2.4: 1 known vulnerability
    GHSA-662x-8wvj-2276
    helper/Cargo.lock
  • low
    rsa@0.10.0-rc.18: 1 known vulnerability
    RUSTSEC-2023-0071
    helper/Cargo.lock
  • low
    fastmcp@4.1.1: 2 known vulnerabilities
    GHSA-7xgj-8392-5q4r, GHSA-vqqp-x5qm-5qp4
    uv.lock
  • low
    fastmcp-slim@4.1.1: 2 known vulnerabilities
    GHSA-7xgj-8392-5q4r, GHSA-vqqp-x5qm-5qp4
    uv.lock
  • low
    joserfc@1.7.5: 1 known vulnerability
    GHSA-9pg5-8c7x-5hfx
    uv.lock
  • low
    mako@1.3.12: 1 known vulnerability
    PYSEC-2026-4243
    uv.lock
  • low
    multidict@6.7.1: 1 known vulnerability
    PYSEC-2026-4244
    uv.lock
  • low
    opentelemetry-api@1.42.1: 1 known vulnerability
    GHSA-xcq7-p3pf-p88h
    uv.lock
  • low
    setuptools@82.0.1: 2 known vulnerabilities
    PYSEC-2026-3447, GHSA-xmj3-9gf7-h52w
    uv.lock
  • low
    @vitest/mocker@5.0.2: 2 known vulnerabilities
    GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp
    web/pnpm-lock.yaml
  • low
    No manifest declaring network access and environment variables (agent.json)

Network activity

During install
files.pythonhosted.orgpypi.orgreleases.astral.sh
While running
Not run — the code wasn't started in this scan

Automated result for the commit shown. See our scan policy. View the scan log

Maintainers can claim the listing to rescan, or dispute a result.

LangAlpha alternatives

View more →

Similar mcp servers in Finance & Trading, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
LangAlpha (this page)
ginlix-ai
2.2kApache-2.0Nov 1, 2026Scanned, no flagged issues
QuantDinger
OpenByteInc
13kApache-2.0Nov 1, 2026Scanned, no flagged issues
FinanceToolkit
JerBouma
5.5kMITNov 1, 2026Scanned, no flagged issues
Tradingview MCP
atilaahmettaner
5.2kMITOct 29, 2026Scanned, no flagged issues
Aktools
akfamily
1.5kMITNov 1, 2026Scanned, no flagged issues
Tradememory Protocol
mnemox-ai
1.4kMITOct 23, 2026Scanned, no flagged issues