How to connect an AI agent to TraderBuddy over MCP

TraderBuddy runs an MCP server, so Claude Code, Cursor and other AI agents can look up a stock, read your alerts and portfolios, and manage alerts, your watchlist, chart drawings, saved scanners, the daily digest and your portfolio transactions without opening the browser. It takes about two minutes to connect. It tracks and alerts; it never trades, and nothing an agent does can place an order.

What you can ask#

Once it is connected, you talk to your agent in plain words and it calls TraderBuddy's tools for you:

• "Give me the full picture on NVDA." Price and 1d to 1y change, the 52-week range, distance from the 50- and 200-day averages, RSI, valuation, analyst ratings, and whether you already watch, hold or have an alert on it.
• "Alert me if SPY closes below its 200-day average."
• "Which of my alerts have triggered this month, and why?"
• "Scan the S&P 500 for stocks with RSI under 30 that are still above their 200-day average, and save it as 'Dip buys'."
• "Draw a support line at 187.50 on AAPL and alert me on it."
• "What are the macro readings that say risk-off right now?"

How it works#

The endpoint is https://trader.smkabir.com/api/mcp/, and it signs you in with a personal access token that you create yourself. There is no OAuth sign-in for agents: Zitadel, the identity provider, does not support the dynamic client registration agents need, so a token is how an agent proves it is acting for you.

Diagram source

direction: right
agent: "AI agent\n(Claude Code, Cursor)"
tb: TraderBuddy API {
  mcp: "MCP server\n/api/mcp/"
  door: "Token check\nscope + allowlist"
  rest: "REST API\nsame as the browser"
  mcp -> door -> rest
}
agent -> tb.mcp: "tool call\nAuthorization: Bearer tb_pat_…"

The MCP server is not a separate service. It lives inside the API, and every tool calls the same REST routes the browser uses, carrying your token. So an agent gets exactly what you get in the browser: the same validation, the same approval check, the same per-user privacy and the same rate limits. Nothing is reimplemented, so nothing can drift or be bypassed.

Step 1: create a token#

In TraderBuddy, open Settings → Agent access → New token. Give it a name you will recognise ("Claude Code on laptop"), choose what it may do, and pick an expiry: 30 days, 90 days or a year. There is no "never".

The token starts with tb_pat_ and is shown once. TraderBuddy keeps only a hash of it, so if you lose it, revoke it and make another. Treat it like a password: anyone holding it can act as you within its scope. Start with read-only, and make a read-and-write token only when you want the agent to change things.

Step 2: give it to your agent#

Claude Code takes one command:

claude mcp add --transport http traderbuddy https://trader.smkabir.com/api/mcp/ \
  --header "Authorization: Bearer tb_pat_…"

Cursor reads ~/.cursor/mcp.json (or .cursor/mcp.json in a project):

{
  "mcpServers": {
    "traderbuddy": {
      "url": "https://trader.smkabir.com/api/mcp/",
      "headers": { "Authorization": "Bearer tb_pat_…" }
    }
  }
}

Any other client that supports a remote (HTTP) MCP server with a custom header works the same way: the URL above, and the header Authorization: Bearer tb_pat_…. Where that goes differs between clients and versions, so follow your client's own documentation. The URL works with or without the trailing slash.

Step 3: check it is connected#

claude mcp list

traderbuddy: https://trader.smkabir.com/api/mcp/ (HTTP) - ✔ Connected

Then ask the agent "Who am I in TraderBuddy?". It calls whoami and answers with your account and whether it is approved. A pending account's token is refused until an admin approves it.

The tools#

Read tools, any token:

Write tools, read-and-write token:

Tools that delete are marked as destructive, so a client can ask you before running them.

What an agent can never do#

These are not settings. They are walls in the API, enforced no matter which client or token is used:

• Trade. There is no order entry anywhere in TraderBuddy.
• Touch notification credentials. It can see that a Slack, Telegram or webhook channel exists and whether it works, but cannot add, change, remove or test one. Otherwise bot tokens would end up in the agent's conversation history.
• Use the admin area, even if your account is an admin. A token carries no roles.
• Create, list or revoke tokens. Only a signed-in browser can, so a leaked read-only token cannot upgrade itself.
• Delete from a portfolio. It can add and correct transactions, but not delete a transaction or a portfolio, rename one, or import a file. Anything it adds wrongly, you remove in the browser.

Anything not on the allowlist is refused by default, and a test fails the build if a new route is added without a decision about whether tokens may reach it.

Things worth knowing#

• Alerts are not live. They are checked once per trading day, after the US close. "Alert me when it crosses 200" means "tell me after the close on the day it did". The agent is told this and should not promise instant notification.
• Money is a string. Prices and quantities come back as exact decimals in strings ("187.500000"), never floats.
• ETFs yes; mutual funds and index levels no. SPY, QQQ and VOO work. VFIAX and the S&P 500 index itself are not in the data, so alert on the tracking ETF.
• Rate limit. 120 requests a minute per token. get_stock_details makes about a dozen requests by itself.
• No duplicate detection for transactions. Ask the agent to read the portfolio's transactions before it adds a statement, and add a given statement once.

When something goes wrong#

To revoke a token, open Settings → Agent access → Revoke. It takes effect on the next request.

For what the rest of TraderBuddy does, see Everything TraderBuddy does.

Written for TraderBuddy 0.18.0, 18 October 2026.