ShinobiData MCP
US-equity research and portfolio analytics as an MCP server — 32 OAuth-protected tools for Claude, ChatGPT, and any MCP-compatible client, live at mcp.shinobidata.com.
Summary
ShinobiData MCP turns the ShinobiData data plane into a Model Context Protocol server so Claude Desktop, the Claude Code plugin, ChatGPT connectors, and any MCP-compatible client can call it directly. It exposes 32 tools across five buckets — portfolio CRUD, portfolio analytics, single-company research, market/sector views, and discovery (`screen`, `search`, `fetch`) — each gated behind a granular OAuth scope so a user grants only what they want at the consent screen. Auth is OAuth 2.1 end-to-end with mandatory PKCE S256, rotating refresh tokens, single-use 10-minute authorization codes, and tokens stored only as SHA-256 hashes. The server aggregates in Postgres overnight so a 200-holding portfolio question returns the same constant-size JSON as a 5-holding one and most analytics calls answer in under a second. Listed in the MCP Registry as `com.shinobidata/research`, with ChatGPT Deep Research support built in via spec-named `search` and `fetch` tools.
Target user
Claude and ChatGPT users who want a real portfolio analyst inside their assistant — P&L tracking, performance vs benchmarks, fundamentals, screening, and market views — plus developers who want a scoped, OAuth-secured equity-data plane any MCP client can call without shared API keys.
- 01
Shipped 32 MCP tools across five scoped buckets — portfolio CRUD (`portfolio:write`), portfolio analytics (`portfolio:read`), single-company research, market/sector views, and discovery (`market:read`) — so a user grants only the scopes they want at the OAuth consent screen and can keep the AI out of their portfolio entirely by skipping `portfolio:write`.
- 02
Implemented OAuth 2.1 end-to-end with mandatory PKCE S256 (plain PKCE rejected), single-use 10-minute authorization codes, rotating refresh tokens that revoke the prior pair on issue, and access tokens persisted only as SHA-256 hashes — no API keys ever live in a client config.
- 03
Designed for constant-size responses: Postgres does the heavy aggregation overnight, so a 200-stock portfolio question returns the same JSON shape as a 5-stock one and the AI narrates instead of looping over rows — most analytics calls resolve in under a second.
- 04
Built first-class ChatGPT Deep Research support by naming the discovery tools `search` and `fetch` per the OpenAI spec, alongside a one-line Claude Code plugin install (`/plugin install shinobidata@shinobidata`) and a copy-paste Claude Desktop / mcp-remote config.
- 05
Exposed quality scores as tools, not just raw numbers — Piotroski F, Altman Z, Beneish M, Magic Formula, and Sloan-style cash quality — so an agent can answer 'is this business actually healthy' rather than reciting line items.
- 06
Published to the MCP Registry as `com.shinobidata/research` with a 90-day audit log (arguments redacted before write) and per-token rate limits that can revoke an abusive token without notice.
A naive design lets the AI fan out one call per holding, which blows up latency and token cost on a large book. The fix is server-side aggregation: every analytics tool reads a daily Postgres snapshot and returns a fixed-shape summary, so 'how concentrated am I in tech?' is a single call whether the portfolio holds 5 names or 200, and the client never pays for row-by-row orchestration.
MCP clients vary wildly in how they handle auth, so the server leans entirely on the OAuth 2.1 well-known endpoints with PKCE S256 mandatory, single-use short-TTL authorization codes, and rotating refresh tokens — letting Claude Desktop, the Claude Code plugin, ChatGPT, and arbitrary MCP clients all authorize from the same discovery metadata with no per-client credential handling and no secret in any config file.
- tool buckets
- 5
- locales
- 4
- audit log retention days
- 90
- license
- MIT (client repo)
- registry id
- com.shinobidata/research