The Robinhood MCP Server provides a comprehensive interface to the Robinhood Crypto API. This server handles authentication, account management, market data retrieval, and trading operations through both REST API and WebSocket interfaces.
Config is the same across clients — only the file and path differ.
{
"mcpServers": {
"robinhood-mcp-server": {
"args": [
"gunicorn"
],
"command": "uvx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
The Robinhood MCP Server provides a comprehensive interface to the Robinhood Crypto API. This server handles authentication, account management, market data retrieval, and trading operations through both REST API and WebSocket interfaces.
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
uvx 'gunicorn' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories — click any category to see the underlying evidence.
Gunicorn HTTP Request/Response Smuggling vulnerability
Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.
Request smuggling leading to endpoint restriction bypass in Gunicorn
Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This
PYSEC-2018-55
gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Others in finance
Real-time financial market data: stocks, forex, crypto, commodities, and economic indicators
A Model Context Protocol (MCP) server that provides AI assistants with direct access to the Spreedly payments API. Enables LLMs to manage gateways, process transactions, tokenize payment methods, and more, through structured, validated tool calls.
MCP server for InsightSentry financial data API - market data, options, screeners, and more
AI agents get on-chain identity, credentials, reputation, escrow, and persistent memory on XRPL.
MCP Security Weekly
Get CVE alerts and security updates for Robinhood Mcp Server and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
The Robinhood MCP Server provides a comprehensive interface to the Robinhood Crypto API. This server handles authentication, account management, market data retrieval, and trading operations through both REST API and WebSocket interfaces.
Clone the repository:
git clone https://github.com/rohitsingh-iitd/robinhood-mcp-server
cd robinhood-mcp-server
Set up a virtual environment (recommended):
# Create a virtual environment
python -m venv venv
# Activate the virtual environment
# On macOS/Linux:
source venv/bin/activate
# On Windows:
# .\venv\Scripts\activate
Install dependencies:
pip install -r requirements.txt
Create a .env file in the project root with the following content:
# Required
ROBINHOOD_API_KEY=your_api_key_here
ROBINHOOD_PRIVATE_KEY=your_base64_encoded_private_key_here
# Optional (with defaults)
HOST=0.0.0.0
PORT=8000
WEBSOCKET_PORT=8001
DEBUG=False
LOG_LEVEL=INFO
LOG_FILE=robinhood_mcp_server.log
RATE_LIMIT_ENABLED=True
RATE_LIMIT_REQUESTS=100
RATE_LIMIT_PERIOD=60
Replace the placeholder values with your actual Robinhood API credentials.
Start the server with the following command:
python -m src.main
This will start:
http://localhost:8000ws://localhost:8001For production use, consider using a production-grade ASGI server like Uvicorn with Gunicorn:
pip install gunicorn uvicorn[standard]
gunicorn src.main:app --worker-class uvicorn.workers.UvicornWorker --bind 0.0.0.0:8000
Start the server with the following command:
python -m src.main
This will start both the REST API server (default port 8000) and the WebSocket server (default port 8001).
GET /auth/status - Check authentication statusGET /account - Get account informationGET /account/holdings - Get account holdings (optional query param: asset_code)GET /market/best-price - Get best bid/ask price (optional query param: symbol)GET /market/estimated-price - Get estimated price for quantity (required query params: symbol, side, quantity)GET /trading/pairs - Get available trading pairs (optional query param: symbol)GET /trading/orders - Get order history (optional query param: status)GET /trading/orders/{id} - Get order detailsPOST /trading/orders - Place a new order
symbol, side, quantitytype, price, time_in_force, stop_priceDELETE /trading/orders/{id} - Cancel an orderThe WebSocket server provides real-time updates for market data and order status.
Connect to the WebSocket server