E*TRADE MCP Server

# Recent Changes Review — E*TRADE MCP Repo This document reviews the current repository state and the most recent changes (initial commit) and provides targeted feedback with prioritized recommendations. ## Scope and Method - Commit history: single initial commit — `7c692b1 Initial commit: Week 1 foundation setup`. - Reviewed added files (per `git log -n 1 --name-status`) across `server/`, `tests/`, `docs/ai_dev/`, `client/`, root `README.md`, and `pyproject.toml`. - Ran a static pass over key modules, docs, and configs to validate structure and execution readiness. ## Summary of Additions - Server skeleton: `server/config.py`, `server/auth/*`, `server/tools/__init__.py`. - Tests: `tests/test_auth.py`, `tests/test_token_store.py`. - Docs: `docs/ai_dev/mcp-server-focused-plan.md`, `docs/ai_dev/mcp-server-implementation-plan.md`. - Root project config: `pyproject.toml`, `.env.example`, `README.md`. - Legacy/reference client: `client/src/*` + `client/README.md`. ## What’s Working Well - Config management via `pydantic-settings` (`server/config.py`): clear env layout and base URL selection. - Encrypted token storage with Fernet (`server/auth/token_store.py`) and comprehensive tests. - OAuth manager encapsulates flow and separates token persistence (`server/auth/oauth_manager.py`); unit tests cover primary paths. - Project packaging scaffolded in `pyproject.toml` with sensible dev extras; `.env.example` is complete and clear. ## Issues and Gaps 1) Broken characters and encoding artifacts in multiple files - Root `README.md` has mojibake in tree/checkboxes. - `docs/ai_dev/*` contain garbled characters in diagrams and checklists. - `server/auth/setup.py` has non-ASCII glyphs embedded in strings and even a broken print statement. - Examples: `server/auth/setup.py:17`, `:39`, `:41`, `:50` show `?`, `�` characters; one line contains invalid Python syntax. 2) Missing entry point referenced by docs and packaging - `pyproject.toml` exposes script `etrade-mcp = "server.main:main"`, but `server/main.py` does not exist. - Root `README.md` and docs reference `python -m server.main` / Claude config pointing to `server.main`. 3) Incomplete server/tooling implementation - `server/tools/__init__.py` exists but no concrete tools (`stock_quotes.py`, `options_quotes.py`) yet. - No MCP server bootstrap (`server/main.py`) to register tools and run stdio transport. 4) Library naming inconsistency across docs - One plan references `@modelcontextprotocol/python-sdk`, another `mcp>=1.2.0`. Align on the Python package name actually used in `pyproject.toml` (`mcp`). 5) Legacy client discrepancies (if used beyond reference) - `client/requirements.txt` only pins `rauth`; the code imports `requests` (e.g., `client/src/etrade_python_client.py:8`). - `client/README.md` paths assume `etrade_python_client` subfolder; current layout uses `client/src`. - `_init_.py` files in `client/src/*` should be `__init__.py` if packages are intended. - `client/setup.py` references a package `etrade_python_client` that doesn’t exist as a package dir. 6) Minor robustness/consistency nits - Error-handling branches in the legacy client sometimes index `response.headers['Content-Type']` without guarding header presence; other places do guard — unify to safe access. - OAuth endpoints in `OAuthSessionManager` are set to `api.etrade.com` (common for both envs historically); confirm against current E*TRADE docs for sandbox behavior. ## Priority Recommendations P0 — Fix syntax/encoding and unblock execution - Replace smart quotes/checkmarks and fix mojibake in: - `server/auth/setup.py` (repair strings; ensure valid Python throughout). - Root `README.md` and `docs/ai_dev/*` (use plain ASCII for diagrams/checklists). - Add the missing entry point `server/main.py` that: - Loads `Config.from_env()` - Ensures tokens exist (or instructs to run `python -m server.auth.setup`) - Registers stub MCP tools and runs stdio server (even no-op) so packaging is runnable. - Ensure `pyproject.toml` script entry points to actual code (`server.main:main`). P1 — Complete minimal MCP server functionality - Implement initial tools module(s) with read-only capabilities: - `server/tools/stock_quotes.py` with `get_stock_quote`, `get_batch_quotes`. - Optionally `options_quotes.py` for chains/quotes (if feasible), or defer to Phase 2. - Wire tool functions into MCP server bootstrap in `server/main.py`. P2 — Documentation and DX polish - Align SDK naming across docs (standardize on `mcp` per `pyproject.toml`). - Verify all CLI snippets (`uv`, paths, module names) match the actual tree. - Add a minimal CONTRIBUTING and pre-commit hooks (`ruff`, `black`) for consistent style. P3 — Legacy client hygiene (if keeping as runnable sample) - Add `requests` to `client/requirements.txt`. - Update `client/README.md` paths and run instructions to match current layout. - Rename `_init_.py` → `__init__.py` or mark the folders as simple modules. - Consider moving `client/` under `examples/` to avoid confusion with the new server. ## Notable File References - Missing entry point referenced in packaging: `pyproject.toml:18` - Broken prints/characters in setup: `server/auth/setup.py:17`, `server/auth/setup.py:39`, `server/auth/setup.py:41`, `server/auth/setup.py:50` - OAuth manager configuration present and tested: `server/auth/oauth_manager.py:1`, `tests/test_auth.py:1` - Token store encryption and tests: `server/auth/token_store.py:1`, `tests/test_token_store.py:1` - Docs plans (good structure; fix encoding): `docs/ai_dev/mcp-server-focused-plan.md:1`, `docs/ai_dev/mcp-server-implementation-plan.md:1` - Legacy client imports `requests`: `client/src/etrade_python_client.py:8` ## Suggested Next Steps (1–2 days) 1. Repair `server/auth/setup.py` strings and remove non-ASCII glyphs; rerun `pytest` to ensure green. 2. Add `server/main.py` (stdio loop, tool registry stub) and verify `uv run python -m server.main` starts. 3. Standardize docs to ASCII, fix SDK package naming and examples; confirm Claude config. 4. If keeping legacy client runnable, patch `client/requirements.txt` and `client/README.md` accordingly. ## Risks / Considerations - Ensure the encryption key strategy is explicit for prod (`ETRADE_TOKEN_KEY` must be set); consider OS keyring as a future enhancement. - Avoid logging sensitive tokens or secrets; current code appears safe but revalidate after adding tools. - Confirm OAuth endpoint usage vs. environment per latest E*TRADE docs.