# LuBot Analytics (remote · mcp.lubot.ai)

Portfolio X-Ray with ETF look-through, file analysis, and website analytics in plain English.

- Trust score: 23/100 (low)
- Change this week: 0
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `mcp.lubot.ai`: 23/100 (this document), [markdown](https://verifymcp.io/servers/lubobali-lubot/mcp.md), [page](https://verifymcp.io/servers/lubobali-lubot/mcp)

## Channel facts

- Endpoint: `https://mcp.lubot.ai/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 57/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not yet verified: we couldn't confirm whether this endpoint requires it.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 0/100
  - Transport check failed: declared streamable-http, but the endpoint returned HTTP 429.
- **Schema Quality & AI Usability**: 0/100
  - Schema not yet verified: we couldn't read the endpoint's schema, or could read only part of its tool list.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 0/100
  - Tool coverage not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.
- **Tool Safety**: 0/100
  - Tool safety not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.
- **Capabilities**: 0/100
  - Capabilities not yet verified: we couldn't read the endpoint's capabilities.

**Unverified: 5 categories.** Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.

## Install

### How do I install the LuBot Analytics MCP server?

LuBot Analytics is a hosted endpoint at https://mcp.lubot.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http lubobali-lubot 'https://mcp.lubot.ai/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "lubobali-lubot": {
      "url": "https://mcp.lubot.ai/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "lubobali-lubot": {
      "type": "http",
      "url": "https://mcp.lubot.ai/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.lubobali-lubot]
url = "https://mcp.lubot.ai/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "lubobali-lubot": {
      "type": "remote",
      "url": "https://mcp.lubot.ai/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add lubobali-lubot --url 'https://mcp.lubot.ai/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  lubobali-lubot:
    url: "https://mcp.lubot.ai/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "lubobali-lubot": {
      "Transport": "http",
      "Url": "https://mcp.lubot.ai/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add lubobali-lubot -t streamable-http -u 'https://mcp.lubot.ai/mcp'
```

### Other

```json
{
  "mcpServers": {
    "lubobali-lubot": {
      "type": "http",
      "url": "https://mcp.lubot.ai/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-28 (score 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-25 (score 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-08-31 (score 0)

- [security regression] Endpoint reachability: reachable → not serving MCP
- [security regression] Tool safety: pass → unverified
- [security regression] Authorization: partial → unverified
- [security regression] Transport: pass → fail
- [functional regression] Schema quality: 100 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified

### 2026-08-30 (score 0)

First indexed and scored.

## MCP tools (9)

### `list_files` (~120 tokens)

List My Files

List files the authenticated user has uploaded to LuBot.

    The response has two `content[]` entries: a pre-rendered
    plain-English summary (priority: 1.0, audience: user+assistant),
    plus a raw-JSON block + `structuredContent` field (priority: 0.3,
    audience: assistant only) for programmatic consumers or when the
    caller explicitly asks for raw data.

    Signed-in callers with no uploads yet see a shared demo corpus
    with a demo-mode call-to-action.

### `analyze_file` (~217 tokens)

Analyze a File

File ownership check + LuBot analysis surface routing.

    Returns a lightweight AnalysisResult: confirms the file exists +
    is in the caller's tenant (or the shared demo corpus when the
    caller has no uploads yet), surfaces its metadata, and points the
    user at the full LuBot My Files chat for the deep PhD-level
    answer. Deeper fields — chart, narrative, and richer citations
    beyond the single-file ownership evidence — populate on the full
    chat surface once that pipeline is wired.

    The response has two `content[]` entries: a pre-rendered narrative
    + citations (priority: 1.0, audience: user+assistant), plus a
    raw-JSON block + `structuredContent` field including chart data
    when available (priority: 0.3, audience: assistant only) for
    programmatic consumers or when the caller explicitly asks for raw
    data.

Input parameters:

- `file_id` (string, required)
- `question` (string, required)

### `ping` (~19 tokens)

Health Check

Return a small health-check payload. Safe to call anonymously.

### `analyze_portfolio` (~239 tokens)

Analyze My Portfolio

PhD-style analysis over the caller's portfolio.

    Returns a two-block response. The first `content[]` entry is a
    pre-rendered plain-English summary (priority: 1.0, audience:
    user+assistant). The second entry + `structuredContent` field
    carry the underlying JSON (priority: 0.3, audience: assistant
    only) for programmatic consumers or when the caller explicitly
    asks for raw data.

    Concentration risk (low/medium/high), diversification score
    (0-10), sector breakdown (with ETF look-through decomposition
    when the fund is known), biggest winner + loser by dollar impact,
    plus a 2-4 sentence LLM narrative that ties it together.

    Anonymous callers + hard-fail engine paths get an honest empty
    response with a signup nudge. Signed-in callers with no positions
    yet see a shared demo portfolio with a demo-mode call-to-action
    in the summary. Positions with unavailable live prices are
    labeled honestly — the narrator does not compute aggregate P&L
    over incomplete data.

### `list_portfolio` (~162 tokens)

List My Portfolio Holdings

List the caller's portfolio holdings.

    Returns positions merged from Plaid-synced brokerage + manually-
    entered trades. The response has two `content[]` entries: a
    pre-rendered plain-English summary (priority: 1.0, audience:
    user+assistant), plus a raw-JSON block + `structuredContent`
    field (priority: 0.3, audience: assistant only) for programmatic
    consumers or when the caller explicitly asks for raw data.

    Anonymous callers → honest empty + signup nudge. Signed-in
    callers with no positions yet → shared demo portfolio with
    demo_mode=true. Positions with unavailable live prices are
    labeled honestly rather than reported as fabricated zero P&L.

### `stock_analysis` (~236 tokens)

Analyze a Stock

Ticker validation + LuBot analysis surface routing.

    Returns a lightweight AnalysisResult: ticker validation, source
    label (`watchlist` vs `public`), a narrative pointing the user at
    the full LuBot analyst, and (when available) an upgrade hint. The
    deeper fields — live price, fair value, thesis, risks, and
    recommendation — currently populate only for watchlist-tagged
    calls; the public path leaves them null.

    The response has two `content[]` entries: a pre-rendered
    plain-English summary (priority: 1.0, audience: user+assistant),
    plus a raw-JSON block + `structuredContent` field (priority: 0.3,
    audience: assistant only) for programmatic consumers or when the
    caller explicitly asks for raw data.

    Anonymous callers get the zero-setup public path (rate-limited to
    protect against abuse). Authenticated callers get a
    watchlist-tagged response + upgrade hints when the ticker isn't
    in their watchlist.

Input parameters:

- `ticker` (string, required)

### `list_watchlist` (~136 tokens)

List My Stock Watchlist

List tickers the authenticated user has added to their LuBot
    watchlist.

    Returns symbols + added_at, ordered by add time. The response has
    two `content[]` entries: a pre-rendered plain-English summary
    (priority: 1.0, audience: user+assistant), plus a raw-JSON block +
    `structuredContent` field (priority: 0.3, audience: assistant
    only) for programmatic consumers.

    Anonymous callers get an empty list — the watchlist requires a
    LuBot account. Sign in at https://lubot.ai/connect.

### `list_websites` (~85 tokens)

List Connected Websites

List website projects the authenticated user can query.

    The response has two `content[]` entries: a pre-rendered
    plain-English summary (priority: 1.0, audience: user+assistant),
    plus a raw-JSON block + `structuredContent` field (priority: 0.3,
    audience: assistant only) for programmatic consumers.

### `website_summary` (~198 tokens)

Website Traffic Summary

Return traffic summary for one of the caller's websites.

    Args:
        site_id: One of the site_ids returned by list_websites.
        start_date: Inclusive range start in ISO format (YYYY-MM-DD).
        end_date: Inclusive range end in ISO format (YYYY-MM-DD).
            The window must not exceed 90 days.

    The response has two `content[]` entries: a pre-rendered summary
    (narrative + total visits + top countries + top pages + AI-noticed
    cards) at priority: 1.0, audience: user+assistant, plus a raw-JSON
    block + `structuredContent` field at priority: 0.3, audience:
    assistant only for programmatic consumers or when the caller
    explicitly asks for raw data.

Input parameters:

- `end_date` (string, required)
- `site_id` (string, required)
- `start_date` (string, required)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/lubobali-lubot/mcp#diagnostics

## Score history

- 2026-11-05: 23
- 2026-11-04: 23
- 2026-11-03: 23
- 2026-11-02: 23
- 2026-11-01: 23
- 2026-10-31: 23
- 2026-10-30: 23
- 2026-10-29: 23
- 2026-10-28: 23
- 2026-10-27: 23
- 2026-10-26: 23
- 2026-10-25: 23
- 2026-10-24: 23
- 2026-10-23: 23
- 2026-10-22: 23
- 2026-10-21: 23
- 2026-10-20: 23
- 2026-10-19: 23
- 2026-10-18: 23
- 2026-10-17: 23
- 2026-10-16: 23
- 2026-10-15: 23
- 2026-10-14: 23
- 2026-10-13: 23
- 2026-10-12: 23
- 2026-10-10: 23
- 2026-10-08: 23
- 2026-10-06: 23
- 2026-10-04: 23
- 2026-10-03: 23

## Common questions

### What is the LuBot Analytics MCP server?

LuBot Analytics is an MCP server listed in the public MCP registry as io.github.lubobali/lubot. Portfolio X-Ray with ETF look-through, file analysis, and website analytics in plain English. This page covers its hosted endpoint (https://mcp.lubot.ai/mcp).

### Is the LuBot Analytics MCP server safe to use?

LuBot Analytics scores 23 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the LuBot Analytics MCP server expose?

LuBot Analytics exposes 9 tools: list_files, analyze_file, ping, analyze_portfolio, list_portfolio, and 4 more. Their descriptions and schemas cost roughly 1,412 tokens of context every time the server is loaded.

### Does the LuBot Analytics MCP server require authentication?

Its publisher declares no required credentials for LuBot Analytics. We have not been able to confirm that against the live endpoint, and a server can require authorisation without declaring it here.

### Is the LuBot Analytics MCP server still maintained?

LuBot Analytics is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://mcp.lubot.ai/mcp
- Repository: https://github.com/lubobali/lubot-private-mirror
- Website: https://lubot.ai/
- Changelog RSS feed: https://verifymcp.io/servers/lubobali-lubot/mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/lubobali-lubot/mcp.json
- HTML version of this page: https://verifymcp.io/servers/lubobali-lubot/mcp