daviddme/tradingview-indicator-search-mcp-server

Review signals: 1 connection review, 54 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written; resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 2 distinct locations. 7 attributed processes.

OSV reports a known vulnerability in this dependency version. 15 distinct locations. 54 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• search_scripts returns TradingView scripts for a topic query: Real input produced the expected result: trend-following

  Source: | `search_scripts` | Search by topic: "trend following", "scalping", "order blocks". Omit the query for the top/trending feed |

  Input: {"tool": "search_scripts", "arguments": {"query": "trend following", "script_type": "strategies"}}

  Expected: topic slug trend-following in result

  Command: node src/server.js tools/call {"tool": "search_scripts", "arguments": {"query": "trend following", "script_type": "strategies"}}

  Observed: …trend-following\",\n \"page\": 1,\n \"total_available\": 13,\n \"returned\": 13,\n \"has_more\": false,\n \"from_cache\": true,\n \"items\": [\n {\n \"script_id_part\": \"PUB;1bf8829ec2fa45fa95497cd1806edbbe\",\n \"name\": \"NORN WEAVE | THURISAZ\",\n \"author\": \"mm_mitsuya\",\n \"script_type\": \"strategy\",\n \"open_source\": true,\n \"likes\": 153,\n \"version\": \"2\",\n \"symbol\": \"BITGET:SOLUSDT.P\",\n \"interval\": \"120\",\n \"created_at\": \"2026-06-14T08:34:47+00:00\",\n \"chart_url\": \"https://www.tradingview.com/s

Examples

• The documented offline test suite runs and passes: command completed successfully

  Source: README.md Development section

  Input: npm test

  Expected: 60 tests pass

  Command: npm test

  Observed: > [email protected] test > vitest run RUN v2.1.9 <guest-path> ✓ test/integration.test.js (32 tests) 134ms ✓ test/parse.test.js (17 tests) 20ms ✓ test/throttle.test.js (11 tests) 6ms Test Files 3 passed (3) Tests 60 passed (60) Start at 15:28:56 Duration 2.00s (transform 129ms, setup 0ms, collect 252ms, tests 159ms, environment 0ms, prepare 595ms) (node:2995) ExperimentalWarning: SQLite is an experimental feature and might change at any time (Use `node --trace-warnings ...` to show where the warning was created)

Local or hosted: local

Run the TradingView indicator search MCP server over stdio and call search_scripts for a topic, returning live TradingView strategy results with topic slug trend-following

cd <guest-path> && ls -la && cat README.md && python3 --version
cd <guest-path> && (node --version; npm --version) 2>&1; ls .coldpass scripts src test data; cat package.json; echo "CDP=$CDP_URL"; curl -s -m 10 -w "\nHTTP %{http_code}\n" "$CDP_URL/json/version"
cd <guest-path> && npm install 2>&1 | tail -20; echo "rc=$?"
cd <guest-path> && npm test 2>&1 | tail -15; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && cat src/server.js | head -150
cd <guest-path> && sed -n 150,260p src/server.js; echo ----; curl -s -m 15 -o /dev/null -w "tv HTTP %{http_code}\n" https://www.tradingview.com/scripts/trend-following/ ; echo "rc=$?"
cd <guest-path> && { printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"probe","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"search_scripts","arguments":{"query":"trend following","script_type":"strategies"}}}'; sleep 60; } | timeout 120 node src/server.js 2><guest-path> | cut -c1-1500; echo "rc=${PIPESTATUS[1]}"; tail -5 <guest-path>
cd <guest-path> && cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["node","src/server.js"],"cwd":"<guest-path>","tool":"search_scripts","arguments":{"query":"trend following","script_type":"strategies"},"expected_text":"trend-following"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"search_scripts returns TradingView scripts for a topic query","source":"| `search_scripts` | Search by topic: \"trend following\", \"scalping\", \"order blocks\". Omit the query for the top/trending feed |","input":"query trend following","expected":"topic slug trend-following in result","probe_kind":"mcp","argv":["node","src/server.js"],"tool":"search_scripts","arguments":{"query":"trend following","script_type":"strategies"},"expected_text":"trend-following","cwd":"<guest-path>"}]
EOF
python3 -m json.tool .coldpass/probe.json >/dev/null && python3 -m json.tool .coldpass/claims.json >/dev/null && echo OK; grep -cF '| `search_scripts` | Search by topic: "trend following", "scalping", "order blocks". Omit the query for the top/trending feed |' README.md
cd <guest-path> && cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"The documented offline test suite runs and passes","source":"README.md Development section","input":"npm test","expected":"60 tests pass","argv":["npm","test"],"cwd":"<guest-path>","env":{},"expected_text":"60 passed"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README.md and src/server.js. The README documents no cron, loop, webhook, --once or --now scheduler. harvest_scripts is resumable on demand (status paused, call again with harvest_id), which is a caller-driven continuation, not a product schedule. package.json scripts are start, test, test:watch and smoke only."}
EOF
python3 -m json.tool .coldpass/examples.json >/dev/null && python3 -m json.tool .coldpass/cycles.json >/dev/null && echo OK
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -80; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run the TradingView indicator search MCP server over stdio and call search_scripts for a topic, returning live TradingView strategy results with topic slug trend-following","operation_scope":"Linux guest, Node.js v22.23.4 (README requires >=22.5), public TradingView endpoints reachable from the VM, no account or API key. Plus offline npm test suite (60 tests).","steps":["git clone is replaced by the pinned workspace source already present","npm install (README Quick start)","node src/server.js (README Install section, stdio MCP server)","MCP tools/call search_scripts with query \"trend following\" and script_type strategies (README Tools table)","npm test (README Development section)"],"deviations":["Node v22.23.4 and npm 10.9.9 were already installed, so no Node setup was needed.","npm install reported 16 audit vulnerabilities (3 critical, 7 high, 6 moderate); not addressed because the README does not require it and the task forbids editing product source.","The CDP endpoint http://<internal-ip>:9226/json/version returned HTTP 200 (Chrome/155.0.8059.84), but the product makes plain HTTP requests and needs no browser, so it was not used.","The product creates data/indicator_fetch.db on first use; the checker replay was served from cache (from_cache true) after my initial live call.","No cycle: README documents no scheduler, cron, loop, webhook or --once mode, so cycles.json has detected=false."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for this run. Consider running npm audit fix in a separate change if dependency vulnerabilities matter."}
EOF
python3 -m json.tool .coldpass/report.json >/dev/null && echo OK && ls -la .coldpass && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | head -c 300