Sato Hub
Package

alpaca-mcp-server

pypi:alpaca-mcp-server · v2.4.1 · sha256:c86d382d91d9 · as of 2026-11-10

Does it take your key?
no evidence
No private-key read found in what we read of its setup and published code — the limits say how much that was.
No evidence line on file for this question yet.
Does your key leave?
no evidence
Not yet run — we have not run this version with planted test keys.
No evidence line on file for this question yet.
Can it move funds on its own?
declared
Unknown — we could not read what it exposes.
The project says so — README, config, env list or tool description.
What changed?
traced
No change in key, host or fund behaviour since 2.3.2.
Our static read of the published artifact found it.

Is this your project? Respond →Dispute this reading

Hosts contacted

HostWhenRoleEvidence
alpaca.marketscodevendortraced
api.alpaca.marketscodevendortraced
data.alpaca.marketscodevendortraced
docs.alpaca.marketscodevendortraced
paper-api.alpaca.marketscodevendortraced
Evidence (9 lines)
  • tracedT-hosts2026-11-10

    alpaca.markets appears in shipped code (vendor).

    src/alpaca_mcp_server/readme_docs.py

  • tracedT-hosts2026-11-10

    api.alpaca.markets appears in shipped code (vendor).

    src/alpaca_mcp_server/server.py

  • tracedT-hosts2026-11-10

    data.alpaca.markets appears in shipped code (vendor).

    src/alpaca_mcp_server/server.py

  • tracedT-hosts2026-11-10

    docs.alpaca.markets appears in shipped code (vendor).

    src/alpaca_mcp_server/readme_docs.py

  • tracedT-hosts2026-11-10

    paper-api.alpaca.markets appears in shipped code (vendor).

    src/alpaca_mcp_server/server.py

  • declaredD-doc-funds2026-11-10

    The project's own text says it carries out transactions: "Order Management — Place market, limit, stop, stop-limit, and trailing-stop orders for stocks, crypto, and options. Cancel orders individually or in bulk."

    https://raw.githubusercontent.com/alpacahq/alpaca-mcp-server/HEAD/README.md (line 305)

  • declaredD-doc-funds2026-11-10

    The project's own text says it carries out transactions: "9. Place a limit order to buy 100 shares of MSFT at $450."

    https://raw.githubusercontent.com/alpacahq/alpaca-mcp-server/HEAD/README.md (line 326)

  • declaredD-doc-funds2026-11-10

    The project's own text says it carries out transactions: "Order Management — Place market, limit, stop, stop-limit, and trailing-stop orders for stocks, crypto, and options. Cancel orders individually or in bulk."

    https://pypi.org/project/alpaca-mcp-server/2.4.1/#description (line 305)

  • declaredD-doc-funds2026-11-10

    The project's own text says it carries out transactions: "9. Place a limit order to buy 100 shares of MSFT at $450."

    https://pypi.org/project/alpaca-mcp-server/2.4.1/#description (line 326)

Limits

  • The observed lane has not run on this version: not yet run on this version
  • Traced analysis follows flows inside one module and one hop across a relative import; a longer chain is not followed.
  • The observed lane has not run on this version.
  • No tool inventory was available, so fund actions were not read.
  • Traced: Python read line by line, not parsed.

A profile describes what we read and ran, with dates. It is not a safety rating, an audit or an endorsement, and "not found" is not "not there".

sato.custody/v1 · custody-3

Maintain this project? Respond to this reading

Loading sign-in…