FinanceMCP: why it is not safe to use
FinanceMCP did not pass review because it transmits queries and supplied finance API credentials to external services, including an optional hosted endpoint.
What we found
Our review did not find hidden instructions, hardcoded secrets, obfuscation, privilege escalation, or destructive actions in the inspected FinanceMCP repository. The code we reviewed appears focused on read-only financial and news lookups.
The reason this skill did not pass is narrower: it sends user queries, and any finance API credentials provided to it, to third-party services named in the project, including Tushare, optional Qveris, Binance, and public news sources. The README also offers a remotely hosted endpoint at `finvestai.top`, which adds another external destination for requests. For users and teams with stricter privacy expectations, this means prompts and supplied tokens may leave the local environment as part of normal operation.
What to do instead
Use this skill only if you are comfortable with those external data flows and have approved the listed providers and any hosted endpoint for your environment. Prefer self-hosting over a shared remote endpoint when possible. Provide only the minimum credentials needed, avoid sending sensitive prompts or unnecessary account data, and route access through organization-managed secrets and network controls. If you need stronger data-boundary guarantees, choose a skill that keeps requests and credentials entirely within infrastructure you control.
Source: https://github.com/guangxiangdebizi/FinanceMCP
We report what our security review found at the time we checked, with the goal of keeping people safe. Projects change; if a maintainer has since fixed this, we are glad to recheck it. Email hello@agentpod.com.