# Avanza MCP

Independent local Streamable HTTP MCP server for Avanza authentication, account data, instruments, market data, and orders. It uses the unofficial `avanza-api` package. Order tools can affect real money, so keep MCP approval enabled and use `AVANZA_MCP_ALLOWED_ACCOUNT_ID` when authenticated.

> [!WARNING]
> This is an unofficial community project. It is not affiliated with, endorsed
> by, or supported by Avanza Bank AB. Avanza does not provide an official public
> API for this integration, so endpoints may change without notice. You are
> responsible for complying with Avanza's terms and for every action performed
> through your account.

## Setup and run

```powershell
uv sync --extra test
Copy-Item .env.example .env
uv run python -c "import secrets; print(secrets.token_urlsafe(32))"
uv run avanza-mcp-http
```

Paste the generated random value into `AVANZA_MCP_BEARER_TOKEN` in `.env`
before starting the server. Tokens shorter than 32 characters and the published
example placeholder are rejected.

The endpoint is `http://127.0.0.1:8765/mcp` by default. Public market-data tools work without Avanza login credentials; the local MCP bearer token is always required. See [docs/tool-matrix.md](docs/tool-matrix.md) for risk classifications.

Keep the server bound to localhost. Do not expose it directly to the public
internet, reuse the bearer token elsewhere, or commit credentials. Tools that
place, edit, or cancel orders can affect real money and should always require
interactive MCP approval.

Money-affecting tools are blocked even after login unless both
`AVANZA_MCP_ENABLE_LIVE_TRADING=true` and
`AVANZA_MCP_ALLOWED_ACCOUNT_ID=<account-id>` are configured. Keep live trading
disabled for read-only account access. The tools also publish standard MCP
read-only and destructive annotations so compatible clients can apply their
normal approval policies.

## Environment ownership

This project exclusively owns all `AVANZA_*` variables shown in `.env.example`. Never commit `.env`.

## Tests

```powershell
uv run pytest
```

Tests use mocked clients and do not place orders.

## Contributing and security

See [CONTRIBUTING.md](CONTRIBUTING.md) before submitting changes. Report
security issues according to [SECURITY.md](SECURITY.md), never in an issue that
contains credentials, account data, or bearer tokens.

## License

MIT. See [LICENSE](LICENSE).