A-Share Multi-Dimensional Quantitative Analysis

A-Share Multi-Dimensional Quantitative Analysis MCP Server - broker research reports, AI news analysis, and stock comprehensive analysis

This package is inconsistent: the SKILL.md points clients at an external MCP endpoint (42.121.167.42) and expects you to get an API key via WeChat, but the bundle also contains runnable server code with embedded MongoDB credentials and different IPs. Before installing or running anything: 1) Do not run server.py unless you trust the source—running it will connect to a remote MongoDB (hard-coded creds) and open a public HTTP service. 2) Verify the ownership and legitimacy of the advertised endpoint (42.121.167.42) and the MongoDB host (121.43.242.239) — ask the provider for official documentation, who operates those hosts, and why credentials are embedded. 3) Avoid sending your platform credentials or secrets to the WeChat contact; request platform-managed API keys or an official API page. 4) If you only intend to call the remote MCP endpoint, treat it like any external API: review privacy, data retention, and what data you will send. 5) If you need to run or modify the server code, remove hard-coded secrets, rotate any exposed credentials, and host the service in a controlled environment. Given the embedded plaintext credentials and endpoint mismatches, proceed with caution or choose a more transparent provider.

Type: OpenClaw Skill Name: yanpan-finance Version: 1.5.0 The skill provides financial analysis tools by connecting to a remote MongoDB instance (121.43.242.239) and references a hosted MCP server (42.121.167.42). While the code aligns with its stated purpose of A-share market analysis, server.py contains hardcoded database credentials ('tradingagents123') and a default API token ('yanpan-mcp-secret-2026'), which are significant security vulnerabilities. These risks appear to be unintentional design flaws for ease-of-use rather than intentional malice.