daviddme/TradingView-Unified-MCP

Review signals: 1 connection review.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written; resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 18.165.83.74:443 7 attributed processes.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Read a public exchange-qualified quote without account credentials.: Real input produced the expected result: NASDAQ:AAPL

  Source: no chart change or login is needed for the public scanner adapter.

  Input: {"tool": "quote_batch", "arguments": {"symbols": ["NASDAQ:AAPL"]}}

  Expected: NASDAQ:AAPL quote returned with credentials_used false

  Command: /tmp/node24/bin/node src/server.mjs tools/call {"tool": "quote_batch", "arguments": {"symbols": ["NASDAQ:AAPL"]}}

  Observed: NASDAQ:AAPL\",\"ticker\":\"AAPL\",\"last\":347.725,\"open\":349.115,\"high\":351.73,\"low\":345.75,\"change_percent\":-0.14215151341106327,\"change\":-0.49500000000000455,\"volume\":39538645}],\"requested\":1,\"returned\":1,\"missing_symbols\":[],\"symbols_complete\":true,\"complete\":true,\"missing_last_price_symbols\":[],\"source\":\"tradingview_public_scanner\",\"retrieved_at\":\"2026-10-26T00:01:33.030Z\",\"freshness\":\"service response; exchange delay and underlying quote timestamp are not established\",\"credentials_used\":false}"}], "structuredContent": {"quotes": [{"symbol": "NASDAQ:A

Examples

• Documented source and security checks: command completed successfully

  Source: README.md#quick-start

  Input: npm run check; npm run audit:source

  Expected: both checks pass

  Command: /bin/bash -c 'export PATH=/tmp/node24/bin:$PATH; npm run check && npm run audit:source'

  Observed: > [email protected] check > node scripts/check.mjs {"source_files":33,"syntax_checked":54,"runtime_imports_valid":true,"registered_tools":101,"unique_tools":185,"schemas_valid":true} > [email protected] audit:source > node scripts/security-audit.mjs { "gate": "static-source", "files": 33, "findings": [], "passed": true, "scope": "Narrow static checks; run tests/security.test.mjs and the documented live canary audit. This is not proof that unreviewed code or the browser cannot exfiltrate data." }

Local or hosted: local

Read NASDAQ:AAPL quote using MCP quote_batch

pwd && git status --short --branch && git rev-parse HEAD && sed -n '1,240p' README.md
ls -la && git init && git remote add origin https://github.com/daviddme/TradingView-Unified-MCP && git fetch --depth 1 origin 18d167224fb1b07b9d819ba713e5bbeb82556f5d && git reset --mixed FETCH_HEAD && sed -n '1,240p' README.md
id -u; node --version; npm --version; git status --short --branch; git rev-parse HEAD
rg -n 'nvm|nodejs|24|install' README.md | head -30; cat package.json; env | rg 'CDP|PROXY'
curl -fsSL https://nodejs.org/dist/index.json -o /tmp/node-index.json && python3 -c "import json; d=json.load(open('/tmp/node-index.json')); print(next(x['version'] for x in d if x['version'].startswith('v24.')))"
mkdir -p /tmp/node24 && curl -fsSL https://nodejs.org/dist/v24.22.1/node-v24.22.1-linux-x64.tar.xz -o /tmp/node24.tar.xz && tar -xJf /tmp/node24.tar.xz -C /tmp/node24 --strip-components=1 && /tmp/node24/bin/node --version && /tmp/node24/bin/npm --version
export PATH=/tmp/node24/bin:$PATH; npm run check && npm run audit:source
sed -n '1,130p' src/server.mjs; grep -n 'quote_batch' docs/TOOLS.json | head
sed -n '5958,5985p' docs/TOOLS.json; mkdir -p .coldpass
export PATH=/tmp/node24/bin:$PATH; TV_READONLY=1 TV_DATA_DIR=/tmp/tv-coldpass node src/server.mjs
export PATH=/tmp/node24/bin:$PATH; printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"coldpass","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"quote_batch","arguments":{"symbols":["NASDAQ:AAPL"]}}}' | TV_READONLY=1 TV_DATA_DIR=/tmp/tv-coldpass node src/server.mjs
env | grep -Ei 'proxy|cdp'
cat src/features/market-data.mjs 2>/dev/null || find src -iname '*market*'
cat .coldpass/claims.json 2>/dev/null; mkdir -p .coldpass; cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["/tmp/node24/bin/node","src/server.mjs"],"cwd":"<guest-path>","env":{"TV_READONLY":"1","TV_DATA_DIR":"/tmp/tv-coldpass-replay"},"tool":"quote_batch","arguments":{"symbols":["NASDAQ:AAPL"]},"expected_text":"CANCELLED"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Read a public exchange-qualified quote without account credentials.","source":"Read up to 100 exchange-qualified symbols from the public TradingView scanner with zero session credentials.","input":"NASDAQ:AAPL","expected":"a quote result or explicit request error","probe_kind":"mcp","argv":["/tmp/node24/bin/node","src/server.mjs"],"tool":"quote_batch","arguments":{"symbols":["NASDAQ:AAPL"]},"expected_text":"CANCELLED","cwd":"<guest-path>","env":{"TV_READONLY":"1","TV_DATA_DIR":"/tmp/tv-coldpass-replay"}}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Documented source and security checks","source":"README.md#quick-start","input":"npm run check; npm run audit:source","expected":"both checks pass","argv":["/bin/bash","-c","export PATH=/tmp/node24/bin:$PATH; npm run check && npm run audit:source"],"cwd":"<guest-path>"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README and entry points: this is an on-demand MCP tool server, with no product scheduler or recurring cycle.","checks":[]}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
sed -i 's/Read up to 100 exchange-qualified symbols from the public TradingView scanner with zero session credentials./no chart change or login is needed for the public scanner adapter./' .coldpass/claims.json; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay
python3 - <<'PY'
import json
p='.coldpass/probe.json'; d=json.load(open(p)); d['expected_text']='NASDAQ:AAPL'; json.dump(d,open(p,'w'))
p='.coldpass/claims.json'; d=json.load(open(p)); d[0]['expected_text']='NASDAQ:AAPL'; d[0]['expected']='NASDAQ:AAPL quote returned with credentials_used false'; json.dump(d,open(p,'w'))
PY
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Read NASDAQ:AAPL quote using MCP quote_batch","operation_scope":"Public TradingView scanner; Node.js 24.22.1; no browser or login required","steps":["Installed Node.js 24.22.1 in /tmp/node24","npm run check","npm run audit:source","Started documented stdio MCP server and called quote_batch","Checker replayed the quote call successfully"],"deviations":["The first quote request returned CANCELLED; replay succeeded and returned NASDAQ:AAPL with credentials_used false."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF