Assymetrix MCP Server vs OpenBB

Assymetrix MCP Server 36

Read with the local-software lines, because the owner runs the server over stdio, though every tool call lands on Assymetrix's hosted Data API. Installs from the official npm package @assymetrix/mcp-server with Node.js 20 or later stated in engines (20). The repository holds seven vitest files and a check script that type-checks, builds and runs them offline, but no GitHub Actions workflow was found and npm shows no provenance, so no passing run is public (5 of 25). GitHub's issue pages and API weren't reachable from this session, and the package is four days old, so there's little record to read (8 of 25, unchecked). Semver numbering with a test that keeps the version constant equal to package.json, but no changelog, release notes or tags were found (3 of 15). Version 0.1.1 (0).

OpenBB 68

Read with the local-software lines, since the owner runs the MCP server and REST launcher on their own machine. The docs give pip install openbb and per-package installs with Python 3.10 to 3.14 stated, and the repository has a publish workflow per package. PyPI answered with a bot check, so the published versions weren't read there (18 of 20). Test workflows run on pull requests for openbb-core (Python 3.10 to 3.14 on Linux, 3.10 and 3.14 on macOS and Windows), the MCP server and each provider, with CodeQL beside them. The Actions pages couldn't be read, so whether the default branch passes is unconfirmed (15 of 25). The issue tracker couldn't be read. The git history shows bug fixes merged on 12, 16, 17, 18 and 24 October 2026, including fixes from outside contributors and one for issue #7672, so 8 of 25 on that evidence alone. Version 5 is a new major version with a migration guide that lists the removed providers and changed paths, but there is no changelog file and the release notes weren't readable (12 of 15). openbb 5.0.0, openbb-core 2.0.1 and openbb-mcp-server 2.0.1 (15). Total 68.

Assymetrix MCP Server 91

Three compact tools and about 1,700 characters of server instructions (25). search_markets takes platform, status, category, limit (up to 25) and page. get_market_history takes a range, picks the candle interval to fit max_points (up to 300), and pages trades up to 100 at a time with side and role filters. Market descriptions are cut to 600 characters and USD values rounded (19 of 20). Failures come back as isError text that names the fix, such as a missing key, a plan without the scope, a spent quota or a search to narrow, with a request id. Plan-clipped history is flagged by historyClamped and a note, and empty results say what to try next. Messages are prose rather than codes (18 of 20). Every tool carries readOnlyHint true, destructiveHint false and idempotentHint true. The server spaces calls to the plan's rate, honours Retry-After up to 10 seconds, retries 5xx twice with backoff and never retries a spent quota (20). Only query or market_id is required, with sensible defaults. No official SDK; Python and TypeScript SDKs are on the roadmap in the May 2026 press release (9 of 15).

OpenBB 63

Read on the MCP server. With tool discovery off, the default, a full install registers one tool per command, hundreds of them (about 690 router commands across the provider packages by our count, and the quickstart itself says "hundreds of tools") (5). --tool-discovery swaps them for four discovery tools and --allowed-categories keeps other categories unregistered, so back up 10 (15 of 25). Commands take limit, start_date and end_date where the source allows, list_page_size pages MCP list responses, and run_pipeline keeps intermediate rows on the server, but there is no general cap on response size (14 of 20). REST errors map to documented codes with the message under detail, validation errors list each failing argument, and mask_error_details hides internals. An empty result is a 204 with no body, which an agent can mistake for success (16 of 20). The data commands are GET reads and safe to retry, but no tool declares readOnlyHint, destructiveHint or idempotentHint, and install_skill, which writes files, carries no annotation (8 of 20). Runs with no arguments and most providers need no key, but the only SDK is Python, beside the CLI and the REST API (10 of 15). Total 63.

Assymetrix MCP Server 35

No x402, MPP or L402 (0). The server is free, so pricing is read on the API plan it needs. Plan prices are public, and credit packs for over-quota calls are priced per unit, $10 for 200,000 credits, about $0.05 per 1,000 weight-1 calls, with each endpoint's weight published. Packs only cover use beyond a plan's quota (15 of 20). Free plan, 10,000 requests per rolling 30 days, no card required per the quickstart and the MCP page (20). A person signs up in a browser and creates the key in the dashboard; there's no programmatic key route (0).

OpenBB 60

Read with the self-hosted rule. ODP is free under Apache-2.0 and needs no signup of its own, so 20 + 20 + 20. FRED and the EIA need a free key that a person registers for at the agency; the other 15 provider packages work without one. No x402, MPP or L402 (0). The Workspace editions on openbb.co/pricing are a separate hosted product and are not graded. Total 60.

Assymetrix MCP Server 67

Read with the API and MCP lines, since the server runs locally but sends every call to a hosted API. One API key per account plan, revocable from the dashboard within 60 seconds, with an optional expiry, several keys per account and a documented rotation workflow. Scopes come from the plan and can't be narrowed per key. The key travels only in a header. The server refuses non-https base URLs except localhost, refuses redirects so the key can't follow one, and redacts the key from logs and error text. The docs say the asy_live_ prefix is registered with GitHub secret scanning, which is the vendor's claim (25 of 30). Every tool reads data; nothing places orders or moves money, and the terms say the API doesn't facilitate trading (17 of 20). Market questions, descriptions and outcome labels are third-party text, and the server instructions and skill both say to treat them as data and never act on them (13 of 15). Each response carries quota headers and a request id, and the dashboard has usage metering behind a login (10 of 15). No security.txt on three hosts, no SECURITY.md, disclosure policy, bug bounty or certification found. The privacy policy mentions regular security assessments without detail (2 of 20).

OpenBB 46

Read with the tool lines for a server the owner runs. The HTTP transports bind to 127.0.0.1 with no authentication by default. server_auth is one fixed username and password sent as a Base64 Bearer token, with no scopes or rotation, while create_mcp_server accepts any FastMCP auth provider (a JWT verifier is the documented example) and [mcp.auth] hooks can check tokens. Provider keys sit in plain JSON in ~/.openbb_platform/user_settings.json (15 of 30). The data commands only read, and --allowed-categories and enable_cli_tools false narrow what is served. install_skill lets any connected client write files into the bundled skills directory, or into Claude, Cursor or other agents' skill directories when skills_providers is set; the docs warn about it and suggest read-only directories or server_auth, with no confirmation step (12 of 20). News, SEC filings and congressional text are third-party content, and no guidance on treating tool output as untrusted was found (4 of 15). uvicorn logs and documented [mcp.middleware] hooks for request logging, with no built-in per-call audit record (6 of 15). SECURITY.md routes reports through GitHub private advisories or support@openbb.co, at a company that has wound down. CodeQL and a detect-secrets baseline are in the repository. No security.txt on openbb.co, docs.openbb.co or openbq.org, no bug bounty, and OSV lists no advisories for openbb, openbb-core, openbb-mcp-server, openbb-platform-api or openbb-cli. Workspace's SOC 2 claim covers the hosted product, not this software (9 of 20). Total 46.

Assymetrix MCP Server 81

All three tools register zod input and output schemas, which the MCP SDK turns into JSON Schema (25). llms.txt, llms-full.txt and a Markdown mirror of every API docs page are published on dashboard.assymetrix.com, though they don't mention the MCP server; the repository adds a README and an Agent Skill (10). Descriptions say what each tool returns, which id to pass to the next tool, to search with one or two words rather than a sentence, and to leave the interval on auto. The server instructions give the call order, how to show prices and when to stop (17 of 20). Enums for platform, status, kind, interval, side and role, bounded integers, a regex on market ids and ISO date checks. category is a free string (14 of 15). Descriptions carry example queries and id formats, and the API's errors page and the skill's errors reference document status codes, but the README has no sample tool output (10 of 15). Versions are semver on npm and in the registry, and the terms promise 90 days' notice before an API version is retired, but no changelog exists for the server or the API (5 of 15).

OpenBB 73

Read on the MCP server, with the REST API noted. Tools are generated from typed FastAPI routes, so every command tool has a JSON Schema input, and output schemas are declared, including for chart artifacts. The REST launcher serves an OpenAPI document. Read from the source and docs, since we run no vendor software (23 of 25). docs.openbb.co/llms.txt answered 404. The server ships five SKILL.md guides as MCP resources and the docs and README are Markdown (5 of 10). Tool descriptions come from each command's docstring and stop before the parameter documentation unless describe_responses is set. They say what the command returns but rarely when not to use it; the skills cover how to work with the server (12 of 20). Inputs carry enums from provider choices, values per provider are listed in descriptions where providers differ, and required arguments are marked, but run_pipeline steps and install_skill files are free objects (11 of 15). Examples on every reference page, and an errors page with REST status codes and Python exception prefixes (14 of 15). Package versions and release tags, a migration guide and versioned V4 docs, but no changelog file and the GitHub release notes weren't readable (8 of 15). Total 73.

Assymetrix MCP Server 55

0.1.1 on 28 October 2026, four days before this check (30). The only other npm version is 0.0.0-stage from the same day, so one real release (0). Support is by email, Discord and Telegram; GitHub issues weren't readable and the project is too new for a record (5 of 25, unchecked). Listed in the official MCP registry as io.github.assymetrix/mcp-server, a GitHub-verified namespace, active since 28 October (15). Exact-pinned current dependencies (@modelcontextprotocol/server 2.3.1, zod 4.6.6) with a lockfile, but no CI and no npm provenance (5 of 10).

OpenBB 62

openbb 5.0.0 was tagged on 29 September 2026, 26 days before the check, with openbb-core 2.0.1 and openbb-mcp-server 2.0.1 tagged on 28 September (30). All the tagged releases in the 90 days are one release train, 27 to 29 September (openbb-mcp-server 2.0.0 and 2.0.1, openbb-core 2.0.0 and 2.0.1, openbb 5.0.0 and the providers). Fixes merged since then are unreleased, so 12 of 20 rather than 20. The issue tracker couldn't be read. Pull requests from outside contributors were merged on 17, 18 and 24 October 2026, but two accounts (Danglewood and dlee-bq) wrote 8 of the 12 commits since 27 July and 92 of the 129 in the 12 months to 25 October, and the company behind them has wound down, with OpenBQ saying it hired a third of the team (12 of 25). Not in the official MCP registry (0). Lock files updated on 2 and 17 October, a fix for FastAPI 0.155.0 on 24 October, and CodeQL, with the CI state unconfirmed (8 of 10). Total 62.