stockbit-mcp

stockbit-mcp

Read-only Model Context Protocol server for Stockbit(Indonesian / IDX market data) — broker summary / bandarmology, quotes, top movers, orderbook,fundamentals, and sentiment. It talks to the same JSON backend the Stockbit apps use, with yourown session. It never places or modifies orders.

⚠️ Unofficial. Not affiliated with, endorsed by, or associated with Stockbit or TradingView.Automated access may conflict with Stockbit's Terms of Use — you use this at your own risk on yourown account. Data is delayed/unofficial and is not financial advice.

Why an HTTP client (not desktop automation)

Stockbit Desktop is a Tauri (WKWebView) app — the Chrome-DevTools approach used by TradingViewMCPs doesn't apply, and isn't needed: the desktop app is a thin client overhttps://exodus.stockbit.com. This server is just another client of that API. SeeSTOCKBIT-API.md for the full reverse-engineered surface.

Auth model

• One credential: a bearer access token (24h), minted from a refresh token viaPOST {exodus}/login/refresh (refresh token in the Authorization header; no reCAPTCHA on refresh).
• Initial login is OAuth + reCAPTCHA gated, so a human logs in once. stockbit-auth login drivesyour own browser over the DevTools Protocol (no extra browser download — Node 24's built-inWebSocket) and captures the refresh token from the login response automatically.
• The refresh token is stored in the macOS Keychain (AES-encrypted file fallback elsewhere).Access tokens are never written to disk. All logs/errors are secret-redacted.

Setup

npm install
npm run build

# One-time login. Opens your existing Chrome/Edge/Brave; log into Stockbit normally and the
# session is captured automatically — no DevTools, no copy-paste.
node dist/bin/stockbit-auth.js login
node dist/bin/stockbit-auth.js status   # check backend + expiry

After this single login, the server auto-refreshes indefinitely — you won't log in again until therefresh token itself expires. The one interactive login is unavoidable (Stockbit's OAuth + reCAPTCHArequire a human once); only the token handling is automated away.

Fallback (login needs a Chromium-family browser). If you only have Safari/Firefox, or theOAuth flow snags, paste a refresh token manually instead — input is hidden:

node dist/bin/stockbit-auth.js bootstrap

Quick test without a refresh token

If you can only grab the 24h access token (the Bearer eyJ… on any /marketdetectors request),run in access-token-only mode — no refresh, stops working at expiry, good for a smoke test:

STOCKBIT_ACCESS_TOKEN='eyJ...' node dist/bin/stockbit-mcp.js

For hands-off operation, bootstrap a refresh token instead (above). The refresh token is in theresponse body of a fresh login (log out → log in with DevTools Network open, filter login),not in a request header.

MCP client registration

Register with your MCP client (e.g. Claude Desktop mcpServers):

{
  "mcpServers": {
    "stockbit": { "command": "node", "args": ["/absolute/path/to/dist/bin/stockbit-mcp.js"] }
  }
}

Tools

Development

npm run typecheck   # tsc --noEmit
npm test            # node --test (redaction, error mapping, refresh rotation, schema drift)
npm run dev:mcp     # run from source via tsx

Status / roadmap

v1 is read-only MCP tools. The src/core/ layer is intentionally UI-agnostic so a CLI and awatch/alert daemon (the two-stage broker-summary → intraday screener) can be added as v2 withouttouching the data layer.

Refresh contract (confirmed via source + live endpoint probe): the main/session token renews atPOST {exodus}/login/refresh with the refresh token in the Authorization: Bearer header and anempty body (see STOCKBIT-API.md §3). The only thing still unverified — because it needs one realrefresh with a valid token — is the exact success-response field names and whether the refresh tokenrotates. src/auth/session.ts::parseRefresh handles both defensively; no code change is expected,but confirm on first bootstrap.