LeanTrading MCP

Connect Cursor, Claude, and other MCP clients to the hosted LeanTrading assistant surface through OAuth 2.1/PKCE.

Hosted server

https://www.leantrading.io/api/mcp

The server requires a LeanTrading OAuth connection and an eligible paid Pro/Elite/Blueprint/Admin account. Product Tester, Explorer, and free accounts are not granted hosted MCP access.

Installation

This repository contains the marketplace metadata and Cursor plugin wrapper. It does not contain credentials and does not require a manually copied Supabase session JWT.

The default OAuth request is read-only. Chart, write, and execute capabilities must be explicitly requested by the client and remain subject to LeanTrading scope checks and confirmation boundaries.

Safety boundaries

• OAuth authorization uses PKCE with the S256 method.
• Access and refresh tokens are not stored in plaintext by the server.
• Entitlements are checked again on every hosted MCP call.
• Webhook secrets are redacted and are not returned by the MCP tools.
• Silent broker order placement is not exposed as an MCP operation.
• Chart and alert mutations require stronger scopes and confirmation flows.

Marketplace listing is not a security certification. Review the source, requested scopes, and the LeanTrading privacy/security notices before connecting an account.

Repository packaging

This directory is the export bundle for the public LeanTrading/leantrading-mcp repository. It contains metadata and a thin wrapper for the hosted service; it does not contain the private server source.

Before submitting it to a marketplace:

1. Keep the repository public and limited to this bundle.
2. Keep the repository URL in server.json and plugin.json synchronized.
3. Keep the hosted endpoint and version in all metadata synchronized with the deployed server.
4. Publish the approved data-retention and deletion policy before final marketplace submission.

Privacy note

MCP requests can expose the user's requested LeanTrading system context, intelligence, risk-preview, advisory, and charting data to the connected client. Hosted MCP calls are audited using server-side metadata such as user, client, event, tool, status, and structured metadata; raw tool arguments are not stored. This metadata is retained only as long as necessary to provide the service, protect it, and comply with legal obligations, then deleted or anonymized when no longer needed. Account deletion remains subject to short backup cycles and statutory retention duties.

MCP hosting and database/authentication subprocessors include Vercel and Supabase. Data-protection requests can be sent to info@leantrading.de.