Safe-by-default local stdio MCP server for the official Toss Securities Open API. Read-only market/account tools are available by default; order operations require explicit trading gates, dry-run defaults, confirmation, and max-order safeguards.
Overview
TossInvest OpenAPI MCP
A local stdio MCP server for the official Toss Securities Open API.
The server is designed for developers who want to inspect account, market, holdings, orderbook, candles, and order history data from MCP clients without exposing secrets to model providers.
Safety defaults:
- Starts without credentials; auth_status reports missing configuration instead of crashing.
- Read-only tools are available by default.
- OAuth access tokens are kept in memory only.
- Secrets, bearer tokens, and account identifiers are redacted from tool output and errors.
- Trading is disabled by default.
- Order tools default to dryRun=true.
- Real order create/modify/cancel operations require explicit environment gates, confirmation text, and max-order limits.
Repository: https://github.com/EthanKlocked/tossinvest-openapi-mcp
Server Config
{
"mcpServers": {
"tossinvest": {
"command": "node",
"args": [
"/absolute/path/to/tossinvest-openapi-mcp/dist/index.js"
],
"env": {
"TOSS_API_KEY": "${TOSS_API_KEY}",
"TOSS_SECRET_KEY": "${TOSS_SECRET_KEY}",
"TOSS_ACCOUNT_SEQ": "${TOSS_ACCOUNT_SEQ}"
}
}
}
}