# Reported issues for stock-scanner-mcp

Pod holds 21 of 64 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [stock-scanner-mcp](/mcp/stock-scanner-mcp).

## Most discussed

### feat: add reddit_watchlist_scan tool — batch Reddit sentiment for workspace watchlists

## Context

The workspace morning briefing scans a user's watchlist across multiple data sources. Adding Reddit sentiment per ticker currently requires N × 4 requests (N tickers × 4 subreddits), which is slow and hits rate limits. A single batch tool that scans all watchlist tickers in one pass would integrate cleanly with the briefing workflow.

## Proposed Tool

**`reddit_watchlist_scan`** — Single-pass Reddit scan for multiple symbols

### How it works

Instead of searching each ticker indivi

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/197) · 2026-04-07 · closed · 12 comments

### feat: unified market data layer with smart provider routing

## Summary

Currently, `stock-scanner-mcp` couples every tool to a specific data provider (e.g., `tradingview_quote`, `finnhub_quote`, `alphavantage_quote`). The LLM must determine which data sources are active, which API keys are configured, and write conditional fallback logic on every call. This creates unnecessary complexity for the AI and leads to suboptimal provider selection.

This issue proposes a **unified, provider-agnostic module** (`unified-market`) that exposes 3 high-level tools wi

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/241) · 2026-07-04 · closed · 6 comments

### enhancement: add market_breadth tool (advance/decline, % above MAs)

## Extracted from #87

Advance/decline ratio, % stocks above 50/200 SMA, new highs vs new lows. Gives broader context for day trade direction beyond just index levels.

Ref: #87 (item 7)

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/92) · 2026-03-18 · closed · 4 comments

### Broken data feeds + earnings estimate reliability gaps (day trade session 2026-03-18)

## Context

Found during a real pre-market day trade options session on 2026-03-18. Built an earnings-focused watchlist for MU, NKE, JBL and momentum plays (WDC, UBER, META, VAL). Several tools returned broken/stale/wrong data that would have led to incorrect trade decisions.

Relates to #81 (LLM Integration Feedback) but these are distinct bugs + new tool proposals.

---

## Bugs — Broken Data Feeds

### 1. `options_put_call_ratio` returning 2019 data (CRITICAL)

**Expected:** Recent 5 trading 

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/87) · 2026-03-18 · closed · 2 comments

### install-skills command does not install any skills

## Summary

Running `npx stock-scanner-mcp install-skills` starts the MCP server successfully but does not install any skills. The output shows all modules loading correctly and 45/49 tools registered, but no skills are added.

## Steps to Reproduce

```bash
npx stock-scanner-mcp install-skills
```

## Actual Behavior

Server starts, all modules load, tools register (45/49), but no skills are installed. The command appears to fall through to the normal server startup instead of performing skill 

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/148) · 2026-03-27 · closed · 1 comment

### feat: add startup module log with enable/skip reasons

## Summary

Improve startup logging to show which modules were enabled or skipped and why, helping users debug "why isn't tool X showing up?" issues.

## Current behavior

Modules with missing keys are skipped with a generic startup log message.

## Proposed behavior

```
[stock-scanner-mcp] Starting v1.9.0...

Modules:
  ✓ tradingview        — enabled (no key required)
  ✓ tradingview-crypto — enabled (no key required)
  ✓ sec-edgar          — enabled (no key required)
  ✓ coingecko          — 

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/122) · 2026-03-21 · closed · 1 comment

### feat: add module structure validation to CI

## Summary

Add a validation script that verifies every module follows the required structure pattern. Runs in CI alongside lint, test, and build.

## What it validates

For each directory in `src/modules/`:
- [ ] Has `index.ts` (module factory)
- [ ] Has `client.ts` (HTTP + cache logic)
- [ ] Has `__tests__/client.test.ts` (test file)
- [ ] `index.ts` exports a `create{Name}Module()` factory function
- [ ] Tool names follow `{module}_{action}` naming convention
- [ ] All tools are wrapped with 

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/120) · 2026-03-21 · closed · 1 comment

### chore: add SECURITY.md with vulnerability reporting process

## Summary

Add `SECURITY.md` with a vulnerability reporting process. As an npm package that handles API keys, users need to know how to report security issues privately.

## Contents

### Supported versions
- Current major version receives security updates

### Reporting a vulnerability
- Report via GitHub private vulnerability reporting (preferred) or email
- Do NOT open public issues for security vulnerabilities
- Expected response: acknowledgment within 48 hours, update within 7 days

### Sc

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/119) · 2026-03-21 · closed · 1 comment

## Most recent

### feat: add Reddit sentiment module — trending tickers, mentions, sentiment scoring

## Context

Gap analysis from the competitive MCP server review identified social sentiment as a strong fit for stock-scanner-mcp. Reddit's public JSON API requires no API key and fits our module pattern exactly. No competitor in our space combines Reddit sentiment with the breadth of data we already offer (options, SEC filings, FRED, forex, Fear & Greed).

## Proposed Module

```
src/modules/reddit/
├── index.ts          # createRedditModule() — 3 tools
├── client.ts         # HTTP calls to red

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/195) · 2026-04-07 · closed · 0 comments

### Workspace minor findings from 4-expert review

## Context
MINOR findings from the 4-expert review of Market Workspace (PR #165). These do not block merge but should be addressed over time.

### TypeScript (m1-m5)
- **m1**: Conflict errors map to `INTERNAL_ERROR` instead of a recoverable error code
- **m2**: Tests use `any` types (`workspaceTools: any[]`, `getTool: any`)
- **m3**: `workspace_save_thesis` schema missing `invalidation`, `nextReviewDate`, `confidence` fields
- **m4**: `WorkspaceSchema` default duplicates `ProfileSchema` defaults

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/185) · 2026-04-07 · closed · 0 comments

### Add error path tests for workspace module

Critical error paths have zero test coverage: (1) corrupted JSON file, (2) withMetadata error boundary, (3) schema validation failure, (4) file deleted between load and save. Add tests for each. Files: src/modules/workspace/__tests__/storage.test.ts, tools.test.ts. Source: QA Review (MAJOR M10).

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/183) · 2026-04-07 · closed · 0 comments

### Reject reserved object keys in watchlist/thesis names

Watchlist names and thesis keys are used directly as object property keys. Names like __proto__, constructor could cause prototype pollution. Reject reserved property names in create_watchlist and save_thesis handlers. Files: src/modules/workspace/index.ts. Source: Security Review (MAJOR M9).

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/182) · 2026-04-07 · closed · 0 comments

### Validate --data-dir path to prevent writes outside home directory

No path validation on --data-dir or STOCK_SCANNER_DATA_DIR. Arbitrary paths accepted — could write workspace files into unintended locations. Resolve with path.resolve() and reject paths outside home directory. Files: src/config.ts, src/index.ts. Source: Security Review (MAJOR M6).

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/179) · 2026-04-07 · closed · 0 comments

### Normalize workspace tool response shapes

Workspace module uses 3 distinct response shapes, violating the same-shape standard. Read tools return raw objects, write tools return { success, message }, get_thesis returns { found, symbol, thesis }. Normalize or document deviation. Files: src/modules/workspace/index.ts, docs/development-standards.md. Source: Architecture Review (MAJOR M5).

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/178) · 2026-04-07 · closed · 0 comments

### Set openWorldHint: false for workspace tools

## Context
Found during 4-expert review of Market Workspace feature (PR #165).

## Finding
**Source:** Architecture Reviewer — **Severity: MAJOR (M4)**

All tools are registered with `openWorldHint: true`. Workspace tools operate exclusively on local files — they should have `openWorldHint: false`. This is a semantic annotation MCP clients use for trust/safety decisions.

## Required Action
Add `openWorld?: boolean` to `ToolDefinition` and set to `false` for workspace tools.

## Files
- `src/sha

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/177) · 2026-04-07 · closed · 0 comments

### Eliminate buildModules() duplication — derive from MODULE_CATALOG

## Context
Found during 4-expert review of Market Workspace feature (PR #165).

## Finding
**Source:** Architecture Reviewer — **Severity: MAJOR (M3)**

`buildModules()` in `src/index.ts` manually instantiates every module with if/else logic (lines 57-86), while `MODULE_CATALOG` (lines 40-53) encodes the same decisions in factory lambdas. Adding workspace required touching both.

## Required Action
Replace `buildModules()` with a loop over `MODULE_CATALOG`.

## Files
- `src/index.ts` (lines 40-8

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/176) · 2026-04-07 · closed · 0 comments

### Fix TOCTOU race in StorageManager.load() — use file handle

## Context
Found during 4-expert review of Market Workspace feature (PR #165).

## Finding
**Source:** TypeScript Expert — **Severity: MAJOR (M2)**

`storage.ts` `load()` calls `readFile()` and `stat()` as two separate operations (lines 47-48). Between the two calls, another writer could modify the file, making `stat.mtimeMs` reflect a newer write than what `raw` contains.

## Required Action
Use `fs.open()` to get a file handle, then call `fileHandle.readFile()` and `fileHandle.stat()` on the s

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/175) · 2026-04-07 · closed · 0 comments

### Make readOnly required or default false in ToolDefinition

## Context
Found during 4-expert review of Market Workspace feature (PR #165).

## Finding
**Source:** TypeScript Expert — **Severity: MAJOR (M1)**

`readOnlyHint: tool.readOnly ?? true` in `src/index.ts:184` means if any workspace tool forgets to set `readOnly: false`, the MCP client treats it as read-only. Dangerous default for a stateful module.

## Required Action
Either make `readOnly` required in `ToolDefinition` (remove the `?`) so the compiler forces every tool to declare it, OR change t

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/174) · 2026-04-07 · closed · 0 comments

### Remove dead wrapHandler with any types in workspace module

## Context
Found during 4-expert review of Market Workspace feature (PR #165).

## Finding
**Source:** TypeScript Expert — **Severity: CRITICAL (C1)**

`wrapHandler` is defined at `src/modules/workspace/index.ts:10-16` but never called. All 7 tool handlers use `withMetadata()` instead. The function introduces two `any` types, violating the project rule: "no `any` in new code."

## Required Action
Delete the `wrapHandler` function entirely. It duplicates what `withMetadata()` already provides (er

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/173) · 2026-04-07 · closed · 0 comments

### feat: add `npx stock-scanner-mcp install-skills` CLI command

## Summary

Add an `install-skills` subcommand to the CLI entry point so users can install trading skills without manually cloning the repo and copying files.

## Context

PR #144 added 16 trading skills that currently require manual installation:
```bash
git clone https://github.com/yyordanov-tradu/stock-scanner-mcp.git
cp -r stock-scanner-mcp/skills/*/ ~/.claude/skills/
```

This should be a single command:
```bash
npx stock-scanner-mcp install-skills
```

## Requirements

### CLI Interface
``

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/145) · 2026-03-25 · closed · 0 comments

### feat: add MCP tool annotations (readOnlyHint) to all tools

## Summary

Add MCP tool annotations to all 47 tools declaring them as read-only. This helps LLM clients understand tool behavior and make better autonomous decisions.

## What are MCP annotations?

MCP protocol supports metadata hints on tools:

```typescript
annotations: {
  readOnlyHint: true,     // Tool only reads data, never modifies anything
  destructiveHint: false, // Tool cannot destroy/delete anything
  openWorldHint: true,    // Tool accesses external services (APIs)
}
```

## Why

-

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/127) · 2026-03-21 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues).