atilaahmettaner/tradingview-mcp

Review signals: 1 connection review, 82 known vulnerability.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 8 distinct locations. 31 attributed processes.

OSV reports a known vulnerability in this dependency version. 11 distinct locations. 82 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• yahoo_price returns a real-time quote: Real input produced the expected result: AAPL

  Source: Real-time quote: price, change %, 52w high/low, market state

  Input: {"tool": "yahoo_price", "arguments": {"symbol": "AAPL"}}

  Expected: quote for AAPL with symbol field

  Command: <guest-path> run tradingview-mcp tools/call {"tool": "yahoo_price", "arguments": {"symbol": "AAPL"}}

  Observed: AAPL\",\n \"price\": 347.725,\n \"previous_close\": 348.22,\n \"change\": -0.495,\n \"change_pct\": -0.14,\n \"currency\": \"USD\",\n \"exchange\": \"NMS\",\n \"market_state\": \"\",\n \"52w_high\": 351.73,\n \"52w_low\": 243.42,\n \"price_source\": \"quote\",\n \"quote_stale\": false,\n \"source\": \"Yahoo Finance\",\n \"timestamp\": \"2026-10-23T21:44:10.736775+00:00\"\n}"}], "isError": false}

• yahoo_price supports crypto symbols: Real input produced the expected result: BTC-USD

  Source: Crypto (BTC-USD, ETH-USD, SOL-USD)

  Input: {"tool": "yahoo_price", "arguments": {"symbol": "BTC-USD"}}

  Expected: quote for BTC-USD

  Command: <guest-path> run tradingview-mcp tools/call {"tool": "yahoo_price", "arguments": {"symbol": "BTC-USD"}}

  Observed: BTC-USD\",\n \"price\": 81247.24,\n \"previous_close\": 81311.8906,\n \"change\": -64.6506,\n \"change_pct\": -0.08,\n \"currency\": \"USD\",\n \"exchange\": \"CCC\",\n \"market_state\": \"\",\n \"52w_high\": 116273.31,\n \"52w_low\": 57747.766,\n \"price_source\": \"quote\",\n \"quote_stale\": false,\n \"source\": \"Yahoo Finance\",\n \"timestamp\": \"2026-10-23T21:44:13.533142+00:00\"\n}"}], "isError": false}

Examples

• Project test suite runs (CONTRIBUTING.md documents uv run pytest): command completed successfully

  Source: CONTRIBUTING.md: uv run pytest

  Input: unit tests

  Expected: all unit tests pass

  Command: <guest-path> run pytest tests/unit -q

  Observed: ........ [ 16%] ........................................................................ [ 33%] ........................................................................ [ 50%] ........................................................................ [ 67%] ........................................................................ [ 84%] .................................................................. [100%] 426 passed in 25.51s warning: The `tool.uv.dev-dependencies` field (used in `pyproject.toml`) is deprecated and will be removed in a future release; use `dependency-groups.dev` instead

• README example prompts are natural-language requests for an AI client, not runnable CLI commands: The README examples are chat prompts to be sent by an MCP client (Claude, Cursor, etc.), not shell commands. Equivalent real tool call is covered by the probe and claims (yahoo_price).

  Source: README.md: Try these first

  Expected: documented command completes successfully

  Observed: The README examples are chat prompts to be sent by an MCP client (Claude, Cursor, etc.), not shell commands. Equivalent real tool call is covered by the probe and claims (yahoo_price).

Local or hosted: both

Get a live stock or crypto quote from the tradingview-mcp stdio server by calling its yahoo_price tool (AAPL and BTC-USD returned real Yahoo Finance prices).

cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat README.md | head -200
cd <guest-path> && sed -n 200,420p README.md
cd <guest-path> && sed -n 420,600p README.md | cut -c1-300; echo ---; ls .coldpass 2>/dev/null; echo ---; which uv git node npm; uv --version 2>&1; git --version
cd <guest-path> && git init -q && git remote add origin https://github.com/atilaahmettaner/tradingview-mcp && git fetch --depth 1 origin 51658d0e873e34e47361786ab0dd1dcee8426c50 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1; git status --short | head -20
curl -LsSf https://astral.sh/uv/install.sh | sh 2>&1 | tail -5; export PATH="$HOME/.local/bin:$PATH"; uv --version
cd <guest-path> && grep -n -A3 "scripts\|requires-python" pyproject.toml | head -30; echo ---; grep -n "uv \|pytest\|make " CONTRIBUTING.md | head -30; echo ---; ls tests scripts; ls .coldpass
cd <guest-path> && export PATH="$HOME/.local/bin:$PATH" && uv sync --dev 2>&1 | tail -8 && echo SYNC_OK && (timeout 600 uv run pytest tests/unit -q 2>&1 | tail -8)
ls -la <guest-path> 2>&1; ls /inputs 2>&1; cd <guest-path> && grep -n "def yahoo_price\|def market_snapshot\|def stock_prices\|def get_technical_analysis" -A4 src/tradingview_mcp/server.py | head -40; echo; env | grep -i proxy | sed 's/=.*/=<set>/'
cd <guest-path> && export PATH="$HOME/.local/bin:$PATH" && cat > <guest-path> <<'EOF'
import asyncio, sys
from mcp import ClientSession, StdioServerParameters
from mcp.client.stdio import stdio_client
async def main():
    params = StdioServerParameters(command="uv", args=["run","tradingview-mcp"], cwd="<guest-path>")
    async with stdio_client(params) as (r, w):
        async with ClientSession(r, w) as s:
            await s.initialize()
            res = await s.call_tool("yahoo_price", {"symbol": "AAPL"})
            print(res.content[0].text[:800])
asyncio.run(main())
EOF
timeout 120 uv run --project <guest-path> python -I <guest-path> 2>&1 | tail -30
cd <guest-path> && echo "HOME=$HOME whoami=$(whoami)"; ls -l $HOME/.local/bin/uv; grep -rniE "cron|schedul|webhook|--once|--now|while True|asyncio.sleep|loop" src/ | grep -v "\.pyc" | head -20; echo ---; grep -n "^#\|uv run\|tradingview" EXAMPLES.md | head -60
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["<guest-path>","run","tradingview-mcp"],"cwd":"<guest-path>","tool":"yahoo_price","arguments":{"symbol":"AAPL"},"expected_text":"\"symbol\": \"AAPL\""}
EOF
cat > .coldpass/claims.json <<'EOF'
[
{"kind":"claim","claim":"yahoo_price returns a real-time quote","source":"Real-time quote: price, change %, 52w high/low, market state","input":"AAPL","expected":"quote for AAPL with symbol field","probe_kind":"mcp","argv":["<guest-path>","run","tradingview-mcp"],"tool":"yahoo_price","arguments":{"symbol":"AAPL"},"expected_text":"\"symbol\": \"AAPL\"","cwd":"<guest-path>"},
{"kind":"claim","claim":"yahoo_price supports crypto symbols","source":"Crypto (BTC-USD, ETH-USD, SOL-USD)","input":"BTC-USD","expected":"quote for BTC-USD","probe_kind":"mcp","argv":["<guest-path>","run","tradingview-mcp"],"tool":"yahoo_price","arguments":{"symbol":"BTC-USD"},"expected_text":"\"symbol\": \"BTC-USD\"","cwd":"<guest-path>"}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: pyproject [project.scripts] tradingview-mcp = tradingview_mcp.server:main is a stdio MCP server started by the client; grep of src/ for cron/schedule/webhook/--once/--now/while-loops found no scheduler or trigger. Product only runs per MCP request, so no product cycle exists.","checks":[]}
EOF
cat > .coldpass/examples.json <<'EOF'
[
{"kind":"example","claim":"Project test suite runs (CONTRIBUTING.md documents uv run pytest)","source":"CONTRIBUTING.md: uv run pytest","input":"unit tests","expected":"all unit tests pass","argv":["<guest-path>","run","pytest","tests/unit","-q"],"cwd":"<guest-path>","expected_text":"426 passed"},
{"kind":"example","claim":"README example prompts are natural-language requests for an AI client, not runnable CLI commands","source":"README.md: Try these first","reason":"The README examples are chat prompts to be sent by an MCP client (Claude, Cursor, etc.), not shell commands. Equivalent real tool call is covered by the probe and claims (yahoo_price)."}
]
EOF
python3 -I -c "import json;[json.load(open('.coldpass/'+f)) for f in ['probe.json','claims.json','cycles.json','examples.json']];print('json ok')" && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -60
cd <guest-path> && python3 -I - <<'EOF'
import json
p='.coldpass/probe.json'; d=json.load(open(p)); d['expected_text']='AAPL'; json.dump(d,open(p,'w'))
p='.coldpass/claims.json'; cl=json.load(open(p))
for c in cl:
    c['expected_text']= 'AAPL' if c['input']=='AAPL' else 'BTC-USD'
json.dump(cl,open(p,'w'),indent=1)
EOF
<env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; python3 -I -c "
import json,sys
d=json.load(open('<guest-path>'))
print('valid:',d.get('valid')); print('problems:',d.get('problems'))
print('evidence:',d.get('evidence_strength'))
" 2>&1 | head -40
cd <guest-path> && pgrep -af tradingview-mcp || echo "no server processes running"; rm -f <guest-path> <guest-path>; mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Get a live stock or crypto quote from the tradingview-mcp stdio server by calling its yahoo_price tool (AAPL and BTC-USD returned real Yahoo Finance prices).","operation_scope":"Self-hosted from source at pinned commit 51658d0e873e34e47361786ab0dd1dcee8426c50, Python 3.12.3, uv 0.13.5, Linux guest with outbound internet access to Yahoo Finance. No API keys needed. Optional Marketaux key not tested (news/sentiment tools not exercised).","steps":["git init; git remote add origin https://github.com/atilaahmettaner/tradingview-mcp; git fetch --depth 1 origin 51658d0e873e34e47361786ab0dd1dcee8426c50; git reset --mixed FETCH_HEAD","curl -LsSf https://astral.sh/uv/install.sh | sh (README 'Install UV' step)","uv sync --dev (README 'Or run from source' / CONTRIBUTING)","uv run pytest tests/unit -q (CONTRIBUTING: 426 passed)","uv run tradingview-mcp (README 'Or run from source'; stdio MCP server), then MCP tools/call yahoo_price with symbol AAPL and BTC-USD"],"deviations":["uv was not installed in the guest; installed with the README's own curl|sh installer into <guest-path> (HOME is <guest-path>).","The task's preflight path /inputs/coldpass-preflight.py does not exist in this VM; used <guest-path> instead.","First checker replay failed because expected_text was the quoted JSON field '\"symbol\": \"AAPL\"'; changed to the returned value 'AAPL' / 'BTC-USD' and re-validated with no problems.","README 'Try these first' examples are chat prompts for an AI client, not shell commands; recorded as a non-runnable example with a reason.","No product scheduler/cron/webhook exists; cycles.json is detected:false.","pip install tradingview-mcp-server (README alternative) was not used; the source path was used because the task pins a commit."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
python3 -I -c "import json;json.load(open('.coldpass/report.json'));print('report ok')"; ls -la .coldpass
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | python3 -I -c "import json,sys; d=json.loads(sys.stdin.read()); print('valid:',d.get('valid'),'problems:',d.get('problems'))"; ps -eo pid,args | grep -c "[t]radingview-mcp"