MCP is becoming the missing layer between AI and markets

For most of the first LLM wave, connecting a model to the market meant writing glue code: a Python script that fetched prices, stuffed them into a prompt and parsed whatever came back. The Model Context Protocol, the open standard Anthropic published in late 2024, replaced that with something closer to a plug: a server exposes tools with typed inputs, and any compliant client (Claude, Cursor, VS Code, Codex, ChatGPT's connectors) can discover and call them.

In 2026 the finance side of that ecosystem has matured in a way that is easy to miss if you only look at the big agent frameworks. Brokers and data vendors now ship official MCP servers. Here is what exists, with live metrics for the open-source ones.

Alpaca MCP Server

Stars

1,016

Stars gained · 7d

+13

Stars gained · 30d

+69

Last push

16 days ago

License

MIT

Massive (Polygon.io) MCP Server

Stars

—

Stars gained · 7d

—

Stars gained · 30d

—

Last push

—

License

—

Financial Datasets MCP Server

Stars

2,306

Stars gained · 7d

+8

Stars gained · 30d

+23

Last push

1 year ago

License

MIT

Twelve Data MCP Server

Stars

82

Stars gained · 7d

+6

Stars gained · 30d

—

Last push

10 days ago

License

—

TradeMemory Protocol

Stars

1,427

Stars gained · 7d

+4

Stars gained · 30d

+16

Last push

2 days ago

License

MIT

OpenBB

Stars

—

Stars gained · 7d

—

Stars gained · 30d

—

Last push

—

License

—

Project	Stars	7d	30d	License	Last push
Alpaca MCP Server	1,016	+13	+69	MIT	16 days ago
Massive (Polygon.io) MCP Server	—	—	—	—	—
Financial Datasets MCP Server	2,306	+8	+23	MIT	1 year ago
Twelve Data MCP Server	82	+6	—	—	10 days ago
TradeMemory Protocol	1,427	+4	+16	MIT	2 days ago
OpenBB	—	—	—	—	—

Execution: Alpaca

Alpaca's MCP server is the clearest example of the protocol crossing from "read data" to "do things". The current version is a complete rewrite built with FastMCP from the broker's OpenAPI specification, and it covers stocks, options and crypto: orders, positions, option exercise, watchlists, asset lookup, market calendar and clock, plus bars, quotes, trades, snapshots and option chains.

Two design choices stand out:

• Paper by default. The ALPACA_PAPER_TRADE setting defaults to true; switching to live trading is an explicit step with separate keys.
• Server-side toolsets. An ALPACA_TOOLSETS variable restricts which groups of tools the server exposes (trading, watchlists, assets, stock-data, crypto-data, options-data). This matters because, as the README points out, MCP clients discover tools dynamically: there is no client-side allow-list, so if you want an assistant to be unable to place orders, the restriction has to live on the server.

The README also warns not to expose the server to the public internet with API keys attached, and that Claude's mobile app, which needs a remote server, is therefore not a supported setup. That is the correct level of paranoia for a tool that can submit orders.

Data: Massive (Polygon.io), Financial Datasets, Twelve Data

Massive (the company formerly known as Polygon.io) took an unusual route. Instead of one tool per endpoint, its server exposes three composable tools, search, call and query, that cover the whole API surface for stocks, options, forex, crypto and futures, can store results in an in-memory SQLite database and come with built-in financial functions including Black-Scholes pricing and greeks. It is a more "agentic" design: the model composes queries instead of picking from a menu.

Financial Datasets ships the menu version: income statements, balance sheets, cash-flow statements, current and historical prices, company news and crypto prices. It is the same API the AI Hedge Fund project uses, which explains its star count. Note that the repository has not been pushed to since mid-2025; the service is live, the server is simply done.

Twelve Data shows where this is going for consumer clients: a hosted remote server with OAuth. You add the connector in Claude, ChatGPT or Codex, log in with your Twelve Data account and the key is linked automatically; no copy-pasting secrets into config files. The self-hosted option with an API key still exists for developers.

OpenBB frames MCP servers as one surface of its Open Data Platform, next to Python, REST and Excel: connect the data once, let agents consume it through MCP. Given that OpenBB already normalises many providers, it is the most likely candidate for "one server to rule them all" in research workflows. Financial Modeling Prep also offers an MCP server on top of its fundamentals API.

The agents are starting to speak MCP too

The protocol is spreading in the other direction as well. TradeMemory Protocol is a 20-tool MCP server that gives any agent persistent memory, planning, risk and an audit trail, and its preview "brake" sits between an agent and Alpaca's own MCP server as a policy proxy. QuantDinger exposes an agent gateway and MCP server so external coding agents can call approved tools. The Kalshi AI Trading Bot ships an MCP server for its prediction-market client. In the audit we published alongside this article, MCP appears in the READMEs of five of the twenty agent projects.

The security model, honestly

MCP standardises access. It does not make access safe. Four things to keep in mind, all of which the better READMEs now say themselves:

1. Keys live in the server's environment. Anyone who can talk to the server can act with those keys. Local stdio servers are fine; remote servers need real authentication, which is why Twelve Data built OAuth and Alpaca tells you not to expose theirs.
2. Restrict on the server, not in the prompt. A system prompt that says "never place orders" is a suggestion. A server that does not expose the trading toolset is a guarantee.
3. Data is untrusted input. A news tool returns text that the model will read. If that text contains instructions, a tool-using model may follow them. Every data MCP server is a prompt-injection surface, and the only mitigation is to keep execution tools out of the same session or behind a human approval step, the way OpenAlice's "trading as Git" and Lumibot's deterministic gate do.
4. Paper first, always. Every execution server in this survey has a sandbox mode. Use it until you are bored of it.

Why "the missing layer" is the right phrase

Before MCP, every agent framework reimplemented data access and broker access, badly and differently. TradingAgents has its own data flows, AI Hedge Fund hard-codes one provider, FinRobot has a data_source directory with a dozen adapters. MCP turns that into a shared layer: the broker maintains the broker server, the vendor maintains the data server, and the agent framework becomes what it should have been all along, a reasoning layer with opinions about how to use tools.

That shifts the interesting question. Access is close to solved. What is not solved is judgement: whether a model, given the same clean tools, makes decisions that survive contact with the market. That is why our research starts with what the systems actually do, as in our audit of twenty agents, and not with another connector.