B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.

App connector · Developer tools, Cloud & infrastructure

tradingview-mcp

MCP server for market analysis in AI assistants: screeners, multi-timeframe technical analysis, backtests and sentiment for crypto, stocks, forex and futures. 39 tools. Self-host free, or use the hosted version, TradingMCP.

Bottom line: Signal-based grade (4/7 points): very widely starred on GitHub, public source code. This reflects adoption and transparency, not a code audit.

Popularity score: 42/100
Rank: #278 of 500
GitHub stars: 5.1k

What it does

Tradingview-mcp connects AI assistants to TradingView's market analysis capabilities, offering 39 tools for technical analysis across multiple timeframes, backtesting, screening, and sentiment analysis for crypto, stocks, forex, and futures. Deploy self-hosted for free or use the managed TradingMCP hosted version.

Who it’s for

Trading-focused AI builders and quant teams needing programmatic access to technical analysis and backtesting within AI agent workflows. Best suited for users comfortable with self-hosting or those evaluating managed market data integrations.

Copy-paste setup

Check these steps against the project’s own instructions before running anything.

Self-hosted (verify against repo README for latest):

Clone: git clone https://github.com/atilaahmettaner/tradingview-mcp
Install: npm install
Configure credentials (TradingView API keys) in .env
Start: npm start
Add to Claude Desktop claude_desktop_config.json:

json

{
  "mcpServers": {
    "tradingview-mcp": {
      "command": "node",
      "args": ["/path/to/tradingview-mcp/dist/index.js"],
      "env": {
        "TRADINGVIEW_API_KEY": "your_key_here"
      }
    }
  }
}

Hosted: Sign up at TradingMCP and obtain API credentials—verify exact setup against the repo README.

Risks

Credential exposure: TradingView API keys stored in environment variables or config files; compromise grants market data and trading capability access
Prompt injection: 39 tools increase surface area; untrusted prompts could manipulate screener/backtest queries to extract unintended data or trigger unintended orders if connected to live trading
Data exfiltration: Sensitive market analysis, backtesting results, or sentiment data could be logged or transmitted outside intended scope if misconfigured
Supply-chain risk: Single-maintainer GitHub repo (5067 stars but unknown update cadence); dependency chain not independently audited
Third-party dependency: Reliance on TradingView API availability, rate limits, and ToS compliance—no independent verification of data accuracy or latency

How to stay secure

Least-privilege permissions

Restrict API key scope: Use read-only TradingView API keys (screeners and analysis only); never grant keys that can execute trades or modify accounts, even if the tool theoretically supports it.
Separate credentials per environment: Use different API keys for testing vs. production; if one is compromised, the other remains safe.
Limit tool access in prompts: Configure the AI agent to access only the 39 tools it actually needs; disable or hide tools for trading execution, account changes, or data export if your use case is analysis-only.
Rotate keys quarterly: Replace API keys every 3 months and immediately if staff with access leave.

Network isolation

Self-host behind a firewall: If using the self-hosted free version, run it on an internal network (not the public internet) and restrict access to trusted IP addresses only.
No direct internet from trading systems: If the AI agent connects to live trading systems, place it in a network segment that cannot directly reach trading platforms; use a one-way data pipe or manual approval step.
Encrypt data in transit: Require HTTPS/TLS for all communication between the AI agent and TradingView API; do not use unencrypted HTTP.
Avoid logging to public services: Don't send logs or backtest results to cloud services (Datadog, Slack, etc.) without encryption and access controls.

Monitoring

Alert on unusual API usage: Set up alerts if the tool makes 10× more screener or backtest requests than normal, which could indicate a prompt-injection attack.
Audit tool calls weekly: Review a log of which tools were invoked, with what parameters, and by whom; flag calls to unexpected tools (e.g., data-export or order-execution tools).
Track API key usage: Monitor which API keys are being used, from which IP addresses, and at what times; disable keys that show suspicious patterns.
Version-pin the connector: Explicitly lock the tradingview-mcp version in your configuration; don't auto-update. Review release notes before upgrading, since the maintainer's update cadence is unknown.

Red flags to watch for

Unexpected data requests: If the AI agent suddenly asks for historical market data, competitor analysis, or sentiment reports outside your normal workflow, investigate before allowing it.
Requests to export or download results: If a prompt tries to trigger bulk data downloads or exports to external services, block it; this is a common exfiltration technique.
Changes to query parameters: If screener or backtest queries include unusual filters, date ranges, or asset lists that don't match your strategy, manually review before execution.
API key hardcoded or unencrypted: If you ever see the TradingView API key in plain text in code, logs, or configuration files accessible to multiple users, rotate it immediately and investigate who had access.

Alternatives

Polygon.io MCP (opens external site) — Real-time market data and technical indicators via Polygon API; more enterprise-focused
yfinance (opens external site) + custom MCP wrapper — Lightweight, free Yahoo Finance data; less full-featured but lower dependency risk
Alpaca Markets API (opens external site) — Live trading + market data; stronger institutional backing, higher security bar
Alpha Vantage MCP (opens external site) — Stock and forex data; simpler scope, more established vendor

Sources

github.com/atilaahmettaner/tradingview-mcp