Reported issues for stock-scanner-mcp

Pod holds 21 of 64 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to stock-scanner-mcp.

Most discussed

feat: add reddit_watchlist_scan tool — batch Reddit sentiment for workspace watchlists

Context

The workspace morning briefing scans a user's watchlist across multiple data sources. Adding Reddit sentiment per ticker currently requires N × 4 requests (N tickers × 4 subreddits), which is slow and hits rate limits. A single batch tool that scans all watchlist tickers in one pass would integrate cleanly with the briefing workflow.

Proposed Tool

reddit_watchlist_scan — Single-pass Reddit scan for multiple symbols

How it works

Instead of searching each ticker indivi

Read the thread · 2026-04-07 · closed · 12 comments

feat: unified market data layer with smart provider routing

Summary

Currently, stock-scanner-mcp couples every tool to a specific data provider (e.g., tradingview_quote, finnhub_quote, alphavantage_quote). The LLM must determine which data sources are active, which API keys are configured, and write conditional fallback logic on every call. This creates unnecessary complexity for the AI and leads to suboptimal provider selection.

This issue proposes a unified, provider-agnostic module (unified-market) that exposes 3 high-level tools wi

Read the thread · 2026-07-04 · closed · 6 comments

enhancement: add market_breadth tool (advance/decline, % above MAs)

Extracted from #87

Advance/decline ratio, % stocks above 50/200 SMA, new highs vs new lows. Gives broader context for day trade direction beyond just index levels.

Ref: #87 (item 7)

Read the thread · 2026-03-18 · closed · 4 comments

Broken data feeds + earnings estimate reliability gaps (day trade session 2026-03-18)

Context

Found during a real pre-market day trade options session on 2026-03-18. Built an earnings-focused watchlist for MU, NKE, JBL and momentum plays (WDC, UBER, META, VAL). Several tools returned broken/stale/wrong data that would have led to incorrect trade decisions.

Relates to #81 (LLM Integration Feedback) but these are distinct bugs + new tool proposals.

Bugs — Broken Data Feeds

1. `options_put_call_ratio` returning 2019 data (CRITICAL)

Expected: Recent 5 trading

Read the thread · 2026-03-18 · closed · 2 comments

install-skills command does not install any skills

Summary

Running npx stock-scanner-mcp install-skills starts the MCP server successfully but does not install any skills. The output shows all modules loading correctly and 45/49 tools registered, but no skills are added.

Steps to Reproduce

npx stock-scanner-mcp install-skills

Actual Behavior

Server starts, all modules load, tools register (45/49), but no skills are installed. The command appears to fall through to the normal server startup instead of performing skill

Read the thread · 2026-03-27 · closed · 1 comment

feat: add startup module log with enable/skip reasons

Summary

Improve startup logging to show which modules were enabled or skipped and why, helping users debug "why isn't tool X showing up?" issues.

Current behavior

Modules with missing keys are skipped with a generic startup log message.

Proposed behavior

[stock-scanner-mcp] Starting v1.9.0...

Modules:
  ✓ tradingview        — enabled (no key required)
  ✓ tradingview-crypto — enabled (no key required)
  ✓ sec-edgar          — enabled (no key required)
  ✓ coingecko          — 

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/122) · 2026-03-21 · closed · 1 comment

### feat: add module structure validation to CI

## Summary

Add a validation script that verifies every module follows the required structure pattern. Runs in CI alongside lint, test, and build.

## What it validates

For each directory in `src/modules/`:
- [ ] Has `index.ts` (module factory)
- [ ] Has `client.ts` (HTTP + cache logic)
- [ ] Has `__tests__/client.test.ts` (test file)
- [ ] `index.ts` exports a `create{Name}Module()` factory function
- [ ] Tool names follow `{module}_{action}` naming convention
- [ ] All tools are wrapped with 

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/120) · 2026-03-21 · closed · 1 comment

### chore: add SECURITY.md with vulnerability reporting process

## Summary

Add `SECURITY.md` with a vulnerability reporting process. As an npm package that handles API keys, users need to know how to report security issues privately.

## Contents

### Supported versions
- Current major version receives security updates

### Reporting a vulnerability
- Report via GitHub private vulnerability reporting (preferred) or email
- Do NOT open public issues for security vulnerabilities
- Expected response: acknowledgment within 48 hours, update within 7 days

### Sc

[Read the thread](https://github.com/yyordanov-tradu/stock-scanner-mcp/issues/119) · 2026-03-21 · closed · 1 comment

## Most recent

### feat: add Reddit sentiment module — trending tickers, mentions, sentiment scoring

## Context

Gap analysis from the competitive MCP server review identified social sentiment as a strong fit for stock-scanner-mcp. Reddit's public JSON API requires no API key and fits our module pattern exactly. No competitor in our space combines Reddit sentiment with the breadth of data we already offer (options, SEC filings, FRED, forex, Fear & Greed).

## Proposed Module

src/modules/reddit/ ├── index.ts # createRedditModule() — 3 tools ├── client.ts # HTTP calls to red

Read the thread · 2026-04-07 · closed · 0 comments

Workspace minor findings from 4-expert review

Context

MINOR findings from the 4-expert review of Market Workspace (PR #165). These do not block merge but should be addressed over time.

TypeScript (m1-m5)

m1: Conflict errors map to INTERNAL_ERROR instead of a recoverable error code
m2: Tests use any types (workspaceTools: any[], getTool: any)
m3: workspace_save_thesis schema missing invalidation, nextReviewDate, confidence fields
m4: WorkspaceSchema default duplicates ProfileSchema defaults

Read the thread · 2026-04-07 · closed · 0 comments

Add error path tests for workspace module

Critical error paths have zero test coverage: (1) corrupted JSON file, (2) withMetadata error boundary, (3) schema validation failure, (4) file deleted between load and save. Add tests for each. Files: src/modules/workspace/tests/storage.test.ts, tools.test.ts. Source: QA Review (MAJOR M10).

Read the thread · 2026-04-07 · closed · 0 comments

Reject reserved object keys in watchlist/thesis names

Watchlist names and thesis keys are used directly as object property keys. Names like proto, constructor could cause prototype pollution. Reject reserved property names in create_watchlist and save_thesis handlers. Files: src/modules/workspace/index.ts. Source: Security Review (MAJOR M9).

Read the thread · 2026-04-07 · closed · 0 comments

Validate --data-dir path to prevent writes outside home directory

No path validation on --data-dir or STOCK_SCANNER_DATA_DIR. Arbitrary paths accepted — could write workspace files into unintended locations. Resolve with path.resolve() and reject paths outside home directory. Files: src/config.ts, src/index.ts. Source: Security Review (MAJOR M6).

Read the thread · 2026-04-07 · closed · 0 comments

Normalize workspace tool response shapes

Workspace module uses 3 distinct response shapes, violating the same-shape standard. Read tools return raw objects, write tools return { success, message }, get_thesis returns { found, symbol, thesis }. Normalize or document deviation. Files: src/modules/workspace/index.ts, docs/development-standards.md. Source: Architecture Review (MAJOR M5).

Read the thread · 2026-04-07 · closed · 0 comments

Set openWorldHint: false for workspace tools

Context

Found during 4-expert review of Market Workspace feature (PR #165).

Finding

Source: Architecture Reviewer — Severity: MAJOR (M4)

All tools are registered with openWorldHint: true. Workspace tools operate exclusively on local files — they should have openWorldHint: false. This is a semantic annotation MCP clients use for trust/safety decisions.

Required Action

Add openWorld?: boolean to ToolDefinition and set to false for workspace tools.

Files

`src/sha

Read the thread · 2026-04-07 · closed · 0 comments

Eliminate buildModules() duplication — derive from MODULE_CATALOG

Context

Found during 4-expert review of Market Workspace feature (PR #165).

Finding

Source: Architecture Reviewer — Severity: MAJOR (M3)

buildModules() in src/index.ts manually instantiates every module with if/else logic (lines 57-86), while MODULE_CATALOG (lines 40-53) encodes the same decisions in factory lambdas. Adding workspace required touching both.

Required Action

Replace buildModules() with a loop over MODULE_CATALOG.

Files

src/index.ts (lines 40-8

Read the thread · 2026-04-07 · closed · 0 comments

Fix TOCTOU race in StorageManager.load() — use file handle

Context

Found during 4-expert review of Market Workspace feature (PR #165).

Finding

Source: TypeScript Expert — Severity: MAJOR (M2)

storage.ts load() calls readFile() and stat() as two separate operations (lines 47-48). Between the two calls, another writer could modify the file, making stat.mtimeMs reflect a newer write than what raw contains.

Required Action

Use fs.open() to get a file handle, then call fileHandle.readFile() and fileHandle.stat() on the s

Read the thread · 2026-04-07 · closed · 0 comments

Make readOnly required or default false in ToolDefinition

Context

Found during 4-expert review of Market Workspace feature (PR #165).

Finding

Source: TypeScript Expert — Severity: MAJOR (M1)

readOnlyHint: tool.readOnly ?? true in src/index.ts:184 means if any workspace tool forgets to set readOnly: false, the MCP client treats it as read-only. Dangerous default for a stateful module.

Required Action

Either make readOnly required in ToolDefinition (remove the ?) so the compiler forces every tool to declare it, OR change t

Read the thread · 2026-04-07 · closed · 0 comments

Remove dead wrapHandler with any types in workspace module

Context

Found during 4-expert review of Market Workspace feature (PR #165).

Finding

Source: TypeScript Expert — Severity: CRITICAL (C1)

wrapHandler is defined at src/modules/workspace/index.ts:10-16 but never called. All 7 tool handlers use withMetadata() instead. The function introduces two any types, violating the project rule: "no any in new code."

Required Action

Delete the wrapHandler function entirely. It duplicates what withMetadata() already provides (er

Read the thread · 2026-04-07 · closed · 0 comments

feat: add `npx stock-scanner-mcp install-skills` CLI command

Summary

Add an install-skills subcommand to the CLI entry point so users can install trading skills without manually cloning the repo and copying files.

Context

PR #144 added 16 trading skills that currently require manual installation:

git clone https://github.com/yyordanov-tradu/stock-scanner-mcp.git
cp -r stock-scanner-mcp/skills/*/ ~/.claude/skills/

This should be a single command:

npx stock-scanner-mcp install-skills

Requirements

CLI Interface

Read the thread · 2026-03-25 · closed · 0 comments

feat: add MCP tool annotations (readOnlyHint) to all tools

Summary

Add MCP tool annotations to all 47 tools declaring them as read-only. This helps LLM clients understand tool behavior and make better autonomous decisions.

What are MCP annotations?

MCP protocol supports metadata hints on tools:

annotations: {
  readOnlyHint: true,     // Tool only reads data, never modifies anything
  destructiveHint: false, // Tool cannot destroy/delete anything
  openWorldHint: true,    // Tool accesses external services (APIs)
}

Why

Read the thread · 2026-03-21 · closed · 0 comments

The remaining reports are on the project's issue tracker.

Reported issues for stock-scanner-mcp

Most discussed

feat: add reddit_watchlist_scan tool — batch Reddit sentiment for workspace watchlists

Context

Proposed Tool

How it works

feat: unified market data layer with smart provider routing

Summary

enhancement: add market_breadth tool (advance/decline, % above MAs)

Extracted from #87

Broken data feeds + earnings estimate reliability gaps (day trade session 2026-03-18)

Context

Bugs — Broken Data Feeds

1. options_put_call_ratio returning 2019 data (CRITICAL)

install-skills command does not install any skills

Summary

Steps to Reproduce

Actual Behavior

feat: add startup module log with enable/skip reasons

Summary

Current behavior

Proposed behavior

Workspace minor findings from 4-expert review

Context

TypeScript (m1-m5)

Add error path tests for workspace module

Reject reserved object keys in watchlist/thesis names

Validate --data-dir path to prevent writes outside home directory

Normalize workspace tool response shapes

Set openWorldHint: false for workspace tools

Context

Finding

Required Action

Files

Eliminate buildModules() duplication — derive from MODULE_CATALOG

Context

Finding

Required Action

Files

Fix TOCTOU race in StorageManager.load() — use file handle

Context

Finding

Required Action

Make readOnly required or default false in ToolDefinition

Context

Finding

Required Action

Remove dead wrapHandler with any types in workspace module

Context

Finding

Required Action

feat: add npx stock-scanner-mcp install-skills CLI command

Summary

Context

Requirements

CLI Interface

feat: add MCP tool annotations (readOnlyHint) to all tools

Summary

What are MCP annotations?

Why

1. `options_put_call_ratio` returning 2019 data (CRITICAL)

feat: add `npx stock-scanner-mcp install-skills` CLI command