StockMap
REMOTE · STOCKMAP.IO
US stock research: a model's nightly 14-day read on each stock, its reasons, and its graded record.
Available components
Last scanned (3 hours ago)
Scores higher than 54% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Finance and Payments
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security57
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (unwatch). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability85
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 1690 tokens (~84/item across 20 items; 12 tools + 8 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
- Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
- Supports UI / widget rendering.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 0
- The server rewrote its instructions, which are the text every model session reads security
- 4 Nov 26 +1
- The server rewrote its instructions, which are the text every model session reads security
- Tool “compare_stocks” rewrote its description, which is the text the model reads security
- Tool “stock_call” rewrote its description, which is the text the model reads security
- 1 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 30 Oct 26 +1
- The server rewrote its instructions, which are the text every model session reads security
- Tool “bitcoin_test” rewrote its description, which is the text the model reads security
- Tool “compare_stocks” rewrote its description, which is the text the model reads security
- Tool “crypto_stocks” rewrote its description, which is the text the model reads security
- Tool “crypto_today” rewrote its description, which is the text the model reads security
- Tool “is_it_altseason” rewrote its description, which is the text the model reads security
- Tool “last_night” rewrote its description, which is the text the model reads security
- Tool “market_map” rewrote its description, which is the text the model reads security
- Tool “my_watchlists” rewrote its description, which is the text the model reads security
- Tool “sector” rewrote its description, which is the text the model reads security
- Tool “stock_call” rewrote its description, which is the text the model reads security
- Stability: unverified → 0.03 ▲ functional
- Schema quality: excellent → good functional
- 29 Oct 26 66
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://stockmap.io/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=stockmap.io | CN=YE1,O=Let's Encrypt,C=US | 2 Nov 2026 | 31 Jan 2027 | ECDSA 256 | ECDSA-SHA384 | 6feb80ae36a49065eb03590dcf89a9d0edd |
| SANs: *.stockmap.io, stockmap.io | ||||||
| CN=YE1,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 5ddd70dd31f801c85c186a7a04b80afe |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of stockmap.io. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| io. | present | 38690 | 8 | Verified |
| stockmap.io. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://stockmap.io/mcp | Verified | 200 | |
| http (plaintext) | http://stockmap.io/mcp | HTTPS enforced | 301 | https://stockmap.io/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
bitcoin_test Did my coins beat Bitcoin? ~169
Did the person's coins beat Bitcoin: their holdings as they would paste them on StockMap's Bitcoin test page ("ETH 2, SOL 40 since Jan 15"), priced then and now beside the same dollars held in Bitcoin, from CoinGecko's prices. Nothing is stored. Arithmetic on past prices: no call on any coin, and no advice on the holdings. Each answer carries the stamp, the sources and the not-advice line.
| Name | Type | Req | Description |
|---|---|---|---|
| holdings | string | yes | The coins and amounts as the person would paste them, with a date if they gave one: "ETH 2, SOL 40, DOGE 10000 since Jan 15" |
| since | – | – | When they bought, for holdings the paste gives no date (the page's "Held since"), YYYY-MM-DD |
| Name | Type | Req | Description |
|---|---|---|---|
| answer_text | string | yes | The page's own sentences, joined |
| as_of | – | – | The feed's time, ISO 8601 UTC |
| card | – | – | The page's share card data, with its image URLs (C-1b) |
| not_advice | string | – | – |
| numbers | array | yes | The page's tiles |
| page_url | string | yes | – |
| question | string | yes | – |
| sentences | array | yes | – |
| source_names | array | yes | – |
| stale | boolean | yes | True when the feed is behind: the page shows the same numbers under a banner |
| stale_reason | – | – | – |
| stamp | string | yes | When the numbers are from, as the page stamps them; two clocks give two stamps |
No examples provided.
compare_stocks Compare stocks ~146
StockMap's published calls on two to five US stocks side by side, the same for every reader, by symbol or company name: each stock's nightly 14-day read (a call or a lean), whether it changed last night, the insights for and against it, and how the model's past calls on it did. Use it when someone asks how two to five US stocks stack up against each other, or which of them the model's calls read stronger. Each answer carries the not-advice line and the run date.
| Name | Type | Req | Description |
|---|---|---|---|
| stocks | array | yes | Two to five US stocks, each by symbol (NVDA, BRK.B) or company name (Nvidia) |
| Name | Type | Req | Description |
|---|---|---|---|
| covers | integer | yes | How many stocks StockMap calls |
| missed | array | – | – |
| not_advice | string | – | – |
| queries | array | yes | – |
| run | – | yes | – |
| stocks | array | yes | In the order asked, each once |
No examples provided.
crypto_stocks Crypto stocks ~87
Which US crypto stocks StockMap's model leans on: how many it leans outperform, neutral or underperform, how many of its graded two-week windows on them were right, and Bitcoin's move since the last US close. The calls are the stock model's, on the stocks, never on coins. Each answer carries the stamp, the sources and the not-advice line.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| answer_text | string | yes | The page's own sentences, joined |
| as_of | – | – | The feed's time, ISO 8601 UTC |
| card | – | – | The page's share card data, with its image URLs (C-1b) |
| not_advice | string | – | – |
| numbers | array | yes | The page's tiles |
| page_url | string | yes | – |
| question | string | yes | – |
| sentences | array | yes | – |
| source_names | array | yes | – |
| stale | boolean | yes | True when the feed is behind: the page shows the same numbers under a banner |
| stale_reason | – | – | – |
| stamp | string | yes | When the numbers are from, as the page stamps them; two clocks give two stamps |
No examples provided.
crypto_today Crypto today ~75
Why crypto is up or down today, from StockMap's Crypto today page: Bitcoin's 24-hour move, how many coins beat it, funding, and the hour's paragraph, every number with its source. Market data with no call on any coin. Each answer carries the stamp, the sources and the not-advice line.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| answer_text | string | yes | The page's own sentences, joined |
| as_of | – | – | The feed's time, ISO 8601 UTC |
| card | – | – | The page's share card data, with its image URLs (C-1b) |
| not_advice | string | – | – |
| numbers | array | yes | The page's tiles |
| page_url | string | yes | – |
| question | string | yes | – |
| sentences | array | yes | – |
| source_names | array | yes | – |
| stale | boolean | yes | True when the feed is behind: the page shows the same numbers under a banner |
| stale_reason | – | – | – |
| stamp | string | yes | When the numbers are from, as the page stamps them; two clocks give two stamps |
No examples provided.
is_it_altseason Is it altseason? ~79
Is it altseason: how many of the top-100 coins (stablecoins out) beat Bitcoin over the last 7 days, beside how many lag it in a typical week, from StockMap's Altseason page. Market data with no call on any coin. Each answer carries the stamp, the sources and the not-advice line.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| answer_text | string | yes | The page's own sentences, joined |
| as_of | – | – | The feed's time, ISO 8601 UTC |
| card | – | – | The page's share card data, with its image URLs (C-1b) |
| not_advice | string | – | – |
| numbers | array | yes | The page's tiles |
| page_url | string | yes | – |
| question | string | yes | – |
| sentences | array | yes | – |
| source_names | array | yes | – |
| stale | boolean | yes | True when the feed is behind: the page shows the same numbers under a banner |
| stale_reason | – | – | – |
| stamp | string | yes | When the numbers are from, as the page stamps them; two clocks give two stamps |
No examples provided.
last_night Last night ~79
What changed in StockMap's calls last night: how many stocks' calls changed band on the market map and the biggest of them, the calls graded last night (made 14 days earlier) with one line on why each was right or wrong, and when the next run starts. Each answer carries the not-advice line and the run date.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| all_changes_url | string | – | – |
| calls_issued | – | – | Calls the run made |
| changed_on_map | – | – | Stocks whose call changed band on the map |
| changes | array | yes | The biggest of them by market cap |
| graded | – | – | The calls graded last night |
| grades | array | yes | – |
| more_changes | integer | yes | The changes not listed; all of them are on /what-changed |
| next_run_utc | – | – | When the next run starts |
| not_advice | string | – | – |
| record_url | string | – | – |
| run | – | yes | The run the night is from: the day it ran and the close it called from |
| run_in_flight | boolean | yes | True: tonight's run has not landed yet, so this is the previous night (B2's name for run.not_landed) |
No examples provided.
market_map Market map ~96
The US stock market on StockMap's map: the 11 sectors, each with its share of the market, its 2-week lean from the model's nightly calls on its stocks, its move on the day and its best and worst stock. A summary, not every stock. Use it when someone asks how the US market looks, or which sectors lead or lag. Each answer carries the not-advice line and the run date.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| map_url | string | – | – |
| not_advice | string | – | – |
| run | – | yes | – |
| sectors | array | yes | Biggest first |
| sectors_url | string | – | – |
| stocks | integer | yes | The stocks on the map |
No examples provided.
my_watchlists My watchlists ~59
The signed-in person's StockMap watchlists: each list's stocks with the model's published call on each (the same call every reader sees), the calls that changed last night first. Each answer carries the not-advice line and the run date.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| lists | array | yes | – |
| not_advice | string | – | – |
| run | – | yes | – |
| url | string | – | – |
No examples provided.
sector Sector ~130
StockMap's read of one US sector or industry, by name (Information Technology, semiconductors, banks): its 2-week lean from the model's nightly calls, how its stocks' calls split, its industries, and its largest stocks with each one's call and move on the day. Use it when someone asks how a US sector or industry looks, or which of its stocks look strong or weak. Each answer carries the not-advice line and the run date.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | A US sector or industry by name: Information Technology, Health Care, semiconductors, banks, software |
| Name | Type | Req | Description |
|---|---|---|---|
| closest | array | – | The sectors and industries it may have meant |
| not_advice | string | – | – |
| query | string | yes | – |
| run | – | yes | – |
| scope | – | – | None when no one sector or industry matched |
No examples provided.
stock_call Stock call ~144
StockMap's published call on one US stock, the same for every reader, by symbol or company name: the model's nightly 14-day read (a call or a lean), the strongest reasons for and against, how its past calls on the stock did, the price and the day's change, and what changed last night. Use it when someone asks how a US stock looks, whether it reads strong or weak right now, or what the model's read on it is. Each answer carries the not-advice line and the run date.
| Name | Type | Req | Description |
|---|---|---|---|
| stock | string | yes | A US stock's symbol (NVDA, BRK.B) or its company name (Nvidia) |
| Name | Type | Req | Description |
|---|---|---|---|
| closest | array | – | The stocks the query may have meant |
| covers | integer | yes | How many stocks StockMap calls |
| not_advice | string | – | – |
| query | string | yes | – |
| run | – | yes | – |
| stock | – | – | None when no one stock matched |
No examples provided.
unwatch Stop watching a stock ~49
Remove a US stock from the signed-in person's StockMap watchlists.
| Name | Type | Req | Description |
|---|---|---|---|
| stock | string | yes | A US stock's symbol (NVDA, BRK.B) or its company name (Nvidia) |
| Name | Type | Req | Description |
|---|---|---|---|
| not_advice | string | – | – |
| removed_from | – | – | The list it was taken off; None: it was on none |
| run | – | yes | – |
| stock | – | yes | – |
| url | string | – | – |
No examples provided.
watch Watch a stock ~108
Add a US stock to the signed-in person's StockMap watchlist: to the list named (made if it is new) or their first list. A stock is on one list at a time, so naming another list moves it.
| Name | Type | Req | Description |
|---|---|---|---|
| stock | string | yes | A US stock's symbol (NVDA, BRK.B) or its company name (Nvidia) |
| watchlist | – | – | The list's name, made if the person has none by that name; left out, their first list |
| Name | Type | Req | Description |
|---|---|---|---|
| already | boolean | – | True: it was on that list already, and nothing changed |
| list | string | yes | The list it is on now |
| moved_from | – | – | The list it was moved off, if it was on another |
| not_advice | string | – | – |
| run | – | yes | – |
| stock | – | yes | – |
| url | string | – | – |
No examples provided.
How do I install the StockMap MCP server?
StockMap is a hosted endpoint at https://stockmap.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · stockmap.io
claude mcp add --transport http io-stockmap-stockmap 'https://stockmap.io/mcp'
What is the StockMap MCP server?
StockMap is an MCP server listed in the public MCP registry as io.stockmap/stockmap. US stock research: a model's nightly 14-day read on each stock, its reasons, and its graded record. This page covers its hosted endpoint (https://stockmap.io/mcp).
Is the StockMap MCP server safe to use?
StockMap scores 69 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the StockMap MCP server expose?
StockMap exposes 12 tools: stock_call, compare_stocks, last_night, market_map, sector, and 7 more. Their descriptions and schemas cost roughly 1,221 tokens of context every time the server is loaded.
Does the StockMap MCP server require authentication?
No. We connected to StockMap without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the StockMap MCP server still maintained?
StockMap is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.