jiuyan-mcp

MCP server for fetching data from 韭研公社 (jiuyangongshe.com).

Prioritizes login-free access to public featured data (timeline, hot rankings, search, full article text, community sections); "Action Alerts" and "Follow Feed" are site login data, available after configuring the web SESSION cookie.

For personal learning and research only. Please respect the site's terms of service; do not scrape at high frequency or use commercially. This repository has no affiliation with the official 韭研公社.

Tools overview

Related MCP server: A-Stock MCP Server

Quick start

git clone <repo-url> && cd jiuyan-mcp
npm install

Register it in your MCP client configuration (e.g., ~/.omp/agent/mcp.json):

{
  "mcpServers": {
    "jiuyan": {
      "type": "stdio",
      "command": "node",
      "args": ["/绝对路径/jiuyan-mcp/src/index.js"],
      "env": {
        "JIYAN_SESSION": "<可选：网页 SESSION cookie 值>"
      }
    }
  }
}

Obtaining the login cookie (JIYAN_SESSION)

1. Log in to www.jiuyangongshe.com； in your browser;

2. F12 → Application/Storage → Cookies → https://www.jiuyangongshe.com;

3. Copy the value named SESSION and fill it into JIYAN_SESSION;

4. Restart the MCP client. When not configured, anonymous tools work as usual, and login tools return a clear prompt.

Signature mechanism (why this server is needed to run)

The 韭研公社 web API (web-api.jiuyangongshe.com/jystock-app) requires a token + timestamp header on every request. The signing material is embedded in the SSR page ({digest, project, serverTime} under an obfuscated key in window.__NUXT__), and the derivation algorithm is hidden in a VM-obfuscated module bundled by Nuxt. This project harvests the webpack module table inside a node:vm sandbox and initializes that module, directly calling its signing function to generate the headers for each request—no browser needed at any point.

Robustness design:

• Both the digest key name and the signing function name are obfuscated artifacts—the digest is extracted with a loose regex, and the signing function is auto-discovered by its "output shape," so it adapts even when the site rotates names on release;

• The signing time window is <10 minutes; when the token expires (errCode=110), the page is automatically re-fetched, the sandbox rebuilt, and one retry is attempted;

• Chunk files are cached in the system temp directory (7 days) to avoid re-downloading ~1.6MB of static assets;

• Adjacent upstream requests are forced to be ≥1s apart—polite rate limiting.

Known limitations

• The "Action Alerts" family and the follow feed are confirmed to require a logged-in state (errCode=1); anonymous access cannot bypass this;

• No web endpoint for "fetching a specific user's historical posts by user_id" was found in any public project; posts from followed people are currently obtained via the follow feed (/api/v2/article/newest/list);

• The old app domain app.jiuyangongshe.com has a version gate (errCode=9); this project does not use it;

• A major frontend version upgrade of the site may change the signing module id, in which case KNOWN_MODULE_IDS will need to be updated.

Structure

src/
  signer.js   # SSR digest 抓取 + vm 沙箱签名函数发现与调用
  api.js      # HTTP 客户端：鉴权头、限速、errCode 映射、110 自动重试
  tools.js    # 8 个 MCP 工具定义与入参 schema
  index.js    # stdio MCP 服务器入口

License

MIT