# IG Integration MCP

MCP server for IG's REST Trading API and Lightstreamer streaming API. It uses stdio, so it works with MCP clients such as Claude Desktop and OpenCode.

## Release 0.2.0

- Use the IG v2 `CST` and `X-SECURITY-TOKEN` session required by Lightstreamer while retaining v3 OAuth for REST requests.
- Add `stream_ohlc_snapshot` to seed an in-progress OHLC candle from REST and update it from 5-minute chart stream data.
- Log MCP startup to the configured rotating file without writing to the stdio protocol stream.
- Validate REST and price-streaming behavior against the demo API.

## Setup

1. Use Python 3.10 or newer and install the project: `python3 -m pip install -e '.[dev]'`.
2. Copy `.env.example` to `.env` and set a separately generated IG API key, identifier, password, and `IG_ENVIRONMENT=demo` or `live`. Do not commit `.env` or `.env.demo`.
3. Start the server with `ig-mcp`.

Example MCP configuration:

```json
{
  "mcpServers": {
    "ig": {
      "command": "ig-mcp",
      "cwd": "/absolute/path/to/ig_integration_mcp_v4"
    }
  }
}
```

## Tools

Focused tools cover accounts, preferences, sessions, markets, historical prices, positions, working orders, confirmations, watchlists, sentiment, OTC trades, bounded Lightstreamer `PRICE`, `ACCOUNT`, `TRADE`, and `CHART` subscriptions, and in-progress OHLC snapshots. `ig_request` provides access to the complete documented REST API where no focused tool exists.

Every `POST`, `PUT`, and `DELETE` request requires `confirm=true`. This includes deals, position/order changes, watchlist mutations, account preferences, session account switches, and all generic mutation calls. Check the configured environment before confirming a state-changing operation.

## Authentication

The server logs in with IG REST API v3. Current IG sessions return an OAuth access token and selected account ID, which are sent as `Authorization: Bearer ...` and `IG-ACCOUNT-ID` on REST requests. Older IG sessions using `CST` and `X-SECURITY-TOKEN` remain supported. All credentials and tokens are redacted from logs and MCP results.

## Logging And Secrets

MCP startup plus every REST request and response are logged to a rotating file specified by `IG_LOG_PATH`, defaulting to `~/.cache/ig-mcp/ig-mcp.log`. MCP uses stdout for its protocol and no operational logs are written there. Passwords, API keys, session tokens, OAuth tokens, and encryption material are recursively redacted in logs and MCP REST results.

## In-Progress OHLC Snapshots

`stream_ohlc_snapshot` seeds the current candle from one REST historical-price bar, then merges bounded `CHART:{epic}:5MINUTE` updates into bid and ask OHLC values. It supports `15MINUTE`, `1HOUR`, `4HOUR`, and `1DAY` timeframes and returns the in-progress candle after each received update. Use `historical_prices` for completed candles.

For example, collect the current 4-hour EUR/USD candle after a single 5-minute update:

```text
stream_ohlc_snapshot(
  epic="CS.D.EURUSD.CFD.IP",
  timeframe="4HOUR",
  updates=1,
  timeout_seconds=15
)
```

## Tests

Run `uv run --extra dev pytest`. Demo validation should use only read-only tools such as `accounts`, `search_markets`, `market_details`, `historical_prices`, and short price or OHLC stream collections. Version 0.2.0 was validated against the demo API for login, accounts, market search, historical prices, price streaming, and a 4-hour in-progress OHLC snapshot.