Longport OpenAPI

<p align="center">

</p>

<h1 align="center">LongPort MCP Server</h1>

<p align="center">
<a href="https://registry.modelcontextprotocol.io/v0/servers/com.longportapp%2Fmcp/versions"></a>
<a href="https://smithery.ai/servers/longport-official/longport-mcp"></a>
<a href="https://lobehub.com/mcp/longport-longport-mcp"></a>
<a href="https://glama.ai/mcp/servers/longport/longport-mcp"></a>
<a href="https://github.com/longportapp/longport-mcp/blob/main/LICENSE"></a>
<a href="https://longportapp.com"></a>
</p>

Official MCP server for the LongPort brokerage. 145 tools across real-time quotes, options, order routing, fundamentals, analyst ratings, calendars, IPO, price alerts, DCA plans, portfolio analytics and community sharelists — covering US and HK markets. Built with Rust using rmcp and axum.

Features

- 145 MCP tools across 13 categories: quotes, trading, fundamentals, screener, market data, calendars, IPO, portfolio, alerts, content, account statements, DCA, and community sharelists
- Stateless architecture -- each request carries a Bearer token forwarded directly to the LongPort SDK; no server-side sessions or database
- OAuth 2.1 resource metadata compliant with RFC 9728, pointing clients to LongPort OAuth for authorization
- JSON response transformation -- field names normalized to snake_case, timestamps converted to RFC 3339, internal counter_id values mapped to human-readable symbols
- Prometheus metrics for monitoring tool calls, latency, and errors
- Configurable via CLI arguments or a JSON config file (CLI takes precedence)

Connect from an MCP client

LongPort operates a hosted endpoint at https://mcp.longportapp.com, so most users don't need to run their own server — just point your MCP client at it and complete OAuth when prompted. Authorization is auto-discovered via RFC 9728.

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or the equivalent on your OS:

{
  "mcpServers": {
    "longport": {
      "url": "https://mcp.longportapp.com"
    }
  }
}

Restart Claude Desktop. On first tool invocation it will open a browser to complete the LongPort OAuth flow.

Claude Code

claude mcp add --transport http longport https://mcp.longportapp.com

Zed

Add to your Zed settings.json (open with zed: open settings):

{
  "context_servers": {
    "longport": {
      "url": "https://mcp.longportapp.com"
    }
  }
}

On first use, Zed will open a browser to complete the LongPort OAuth flow.

Cursor / Cline / Windsurf / other MCP clients

Point the client at https://mcp.longportapp.com using transport streamable-http. OAuth is auto-discovered via RFC 9728; no manual token required.

---

Self-hosting

Prefer running your own instance? Use Docker or build from source.

Docker (recommended)

docker run -p 8443:8443 \
  -v /path/to/certs:/certs:ro \
  ghcr.io/longportapp/longport-mcp \
  --bind 0.0.0.0:8443 \
  --base-url https://mcp.example.com \
  --tls-cert /certs/cert.pem \
  --tls-key /certs/key.pem

> Important: When deploying to a public network, you must set --base-url to the externally reachable URL of your server (e.g. https://mcp.example.com). This URL is returned in the OAuth protected resource metadata and used by MCP clients to discover the authorization server. If not set, it defaults to http://localhost:{port} which will not work for remote clients.

Build from source

cargo build --release
./target/release/longport-mcp

Configure

Create a config file at ~/.longport/mcp/config.json (optional):

{
  "bind": "127.0.0.1:8000",
  "base_url": "https://mcp.example.com",
  "log_dir": "/var/log/longport-mcp"
}

Configuration

| Option | Config Key | CLI Flag | Default | Description |
|--------|-----------|----------|---------|-------------|
| Bind address | bind | --bind | 127.0.0.1:8000 | HTTP server listen address |
| Base URL | base_url | --base-url | auto | Public base URL for resource metadata |
| Log directory | log_dir | --log-dir | (stderr) | Directory for rolling log files |
| TLS certificate | tls_cert | --tls-cert | (none) | PEM certificate file for HTTPS |
| TLS private key | tls_key | --tls-key | (none) | PEM private key file for HTTPS |

CLI arguments override config file values. The config file is read from ~/.longport/mcp/config.json (override with LONGPORT_MCP_CONFIG_DIR).

When tls_cert and tls_key are both set, the server runs HTTPS. Otherwise it falls back to HTTP. The base_url defaults to https://localhost:{port} with TLS or http://localhost:{port} without.

Environment Variables

These are advanced settings — most users do not need to change them. They are primarily useful for connecting to non-production LongPort environments or debugging SDK internals.

| Variable | Default | Description |
|----------|---------|-------------|
| LONGPORT_MCP_CONFIG_DIR | ~/.longport/mcp | Config file directory |
| LONGPORT_HTTP_URL | https://openapi.longportapp.com | LongPort API base URL (also used for OAuth metadata) |
| LONGPORT_QUOTE_WS_URL | wss://openapi-quote.longportapp.com/v2 | Quote WebSocket endpoint |
| LONGPORT_TRADE_WS_URL | wss://openapi-trade.longportapp.com/v2 | Trade WebSocket endpoint |
| LONGPORT_MCP_LOG_PAYLOADS | (unset) | 1 lifts the payload log caps (see Logging and customer data). Never set this in production |
| LONGPORT_LOG_PATH | (none) | SDK internal log path. Leave unset in production — the SDK writes unfiltered request/response bodies there (see Logging and customer data) |

Logging and customer data

MCP requests and responses carry customer data — cash balances, positions, order history — and the upstream SDK frames carry access tokens. None of it belongs in a log file, so the server enforces a cap on the log targets that would print it, independent of RUST_LOG:

| Target | Cap | What it would otherwise print |
|--------|-----|-------------------------------|
| SDK HTTP client | warn | OpenAPI request and full response bodies (INFO) |
| SDK WebSocket client | warn | Every WebSocket frame, auth token included (INFO) |
| SDK trade module | warn | Order push events (INFO) |
| rmcp | info | Decoded MCP requests and full tool results (DEBUG), raw JSON-RPC frames (TRACE) |

The exact target names are listed in src/logging.rs; they carry the SDK's upstream crate names rather than longport_*.

Raising verbosity is therefore safe: RUST_LOG=debug (or even trace) gives you this server's own logs without turning customer data into log lines. Two things do defeat it, both off by default:

- LONGPORT_MCP_LOG_PAYLOADS=1 removes the caps. Use it only against a test account on a local machine.
- LONGPORT_LOG_PATH makes the SDK install a private subscriber that writes its own INFO events — request and response bodies included — into that directory, where this server's filter does not apply. The server logs a warning at startup when it is set.

Authentication

…