Financial MCP servers, and the licence behind them

Two readers arrive here. One wants the mechanism — how a language model actually gets a price, a filing or a fundamentals series. The other wants to know whether the AI-finance tooling they keep reading about is real.

The mechanism is real, small and unusually well specified. What it does not do is the part worth an afternoon. MCP changes how data reaches a model. It changes nothing about who may send it. The entitlement check that sat behind the terminal now sits behind the chat window, and the agreement you signed does not know the difference.

How it works

The Model Context Protocol connects language model applications to outside data and tools over JSON-RPC 2.0. Its specification names three roles: Hosts, the applications that initiate connections; Clients, the connectors inside a host; Servers, the services that provide context and capabilities. A chat application or an editor is the host, holding one client per server you install. A server may offer Resources ("context and data, for the user or the AI model to use"), Prompts ("templated messages and workflows for users") and Tools ("functions for the AI model to execute"). Financial servers are almost entirely the third.

Two standard transports are defined, and choosing between them is a licence decision before an architectural one. stdio runs the server as a subprocess the client launched, newline-delimited over its standard streams: the process is on your machine, holding your key. Streamable HTTP posts each message to one HTTP endpoint, replies arriving as a JSON object or a request-scoped SSE stream: the server is somewhere else, run by somebody else. Semantics are identical across both.

Versions are dated, not numbered: identifiers are YYYY-MM-DD "to indicate the last date backwards incompatible changes were made", and the revision current when this page was last checked was 2026-07-28 — the string to look for in a vendor's documentation.

What a server does not control is most of what matters. The host decides which servers are connected, which tools the model sees, and whether a person is asked before one is called — and the specification is blunt that it "cannot enforce these security principles at the protocol level". It also warns that descriptions of tool behaviour "should be considered untrusted, unless obtained from a trusted server". A server is a wrapper with a schema and a key; every question about rights sits upstream of it.

Why the data industry shipped these so fast

A server over an API a vendor already runs is a weekend's work. It went out anyway because the layer it touches — the interface, the screens, the query language — was always the replaceable one, while the layers underneath are not: who owns the market data industry maps that, and quotes an incumbent's own words about making licensed content reachable this way.

What the server gives you over that REST API is two things, and no new data rights among them. Discoverability: schemas are read at connection time, so nobody writes a client or maps parameter names. Orchestration: one question can cross several tools — resolve a ticker, pull a series, fetch the filing — with no script joining them, and the gain grows with the number of sources rather than the quality of any one. The data still arrives under the same agreement, at the same price, with the same restrictions afterwards.

What the licences actually say

Your market data agreement was written for humans looking at screens and programs consuming feeds — the display and non-display halves of nearly every exchange contract, priced differently because a screen is countable and a process is not. A model sits between: is inference display use, because a person reads the answer, or non-display, because a program consumed the number? Three venues have published an answer, and they differ enough that generalising is a mistake.

London Stock Exchange takes the technology-agnostic line and states it in five words: we license the what, not the how. Real-time data "must be controlled through a technical entitlement system, which permissions, monitors and reports Data on a Unique User ID/Device ID basis"; and — the sentence with a bill attached — where a customer cannot control data processed through an AI solution, "all Devices technically able to access the Data are chargeable". Data "should not be consumed into any artificial intelligence solutions which are hosted or operated by a third party unless approved". Undated; read here on 14 September 2026.

Cboe Global Markets answers the display question directly, in an advisory notice under reference ID C2026013000: use of its data in AI solutions inside a product "may require additional licensing, such as non-display", and recipients are "solely responsible for Data Controls governing access to Cboe Data through AI Solutions, including those hosted by third parties". Distributing any derivative work, including any output of an AI Solution that can be used as a substitute for the Data, needs a separate licence.

CME Group goes furthest, and the scope is the part to get right. Notice DS-45 revises the website display terms — the data published on CME's own site — to say that use of that information "is strictly prohibited for any machine learning (ML), artificial intelligence (AI) or large language model (LLM) purposes", naming training and fine-tuning, inclusion in a vector database for retrieval-augmented generation, and automated generation of trade signals or sentiment indicators. Effective 17 September 2026 for the agreement updates and 1 January 2027 for the website display terms. That is a rule about a public website rather than every licensed CME feed — and the clearest published statement anywhere that a term written for humans has been rewritten because the reader might be a model.

Most vendors have published nothing, and terms that predate the question do not cover it rather than permit it. The model provider's terms belong here too, not only in the privacy conversation, because handing licensed content to a third party is the shape of the redistribution question. Anthropic, on a page dated 16 March 2026, says it will not use commercial customers' chats or coding sessions to train its models unless they opt in. Read the equivalent page for your provider, note its date, and check it describes the tier you are on.

Where the data physically goes

For licensed data this is the decision, not a detail, and the documents above turn on it. A stdio server exposes the data to exactly one third party: the model provider that has to see the tool result to answer. A hosted server adds a second, who holds your key, sees your queries, and whose controls you are relying on to satisfy a clause with your name on it.

Hence running your own for anything licensed. Self-hosted tools includes OpenBB, which runs locally over your own provider keys, and SEC EDGAR MCP, which reads a public source and needs no key — an underrated reason to reach for what is genuinely free. Self-hosting makes nothing private: it removes one intermediary and puts the entitlement controls where you can show them to an auditor.

Read-only, and the other thing

A server that reads prices and one that places orders are different risk objects, and both exist here. SnapTrade's hosted MCP server is read-only and scoped to personal accounts; QuantConnect's lets a model create projects, run backtests and deploy live algorithms. Neither is wrong; not knowing which you installed is, because the failure modes below are tolerable against a read tool and are not against a write one. The specification expects hosts to obtain consent before invoking a tool, but cannot make them.

What breaks, and it is specific to finance

Fetched documents are untrusted input. A filing, a news item or a web page is data the model reads, and an agent that can both fetch a document and call a second tool can be steered by its author.

Arithmetic over tables. Models do this badly and confidently, and a margin computed by a model looks exactly like one from a spreadsheet.

Point-in-time correctness. Ask about 2019 earnings and you get the figure as it stands today, restated, because that is what the source returns. Nothing in the protocol tells the model the number reported at the time was different.

No audit trail by default. A transcript is not a record of which tool returned which figure — which stops being an inconvenience the moment anyone regulated is involved. FINRA's 2026 oversight report applies Rule 3110 supervision to these tools and points at storing prompt and output logs and tracking which model version was used and when.

What it is genuinely good at

Without hedging, because a page of only warnings is worth less.

Navigating documents. Finding the segment disclosure or the guidance paragraph in a 10-K is exactly this. Quartr and BamSEC exist because getting to the document is the job, and SEC EDGAR MCP does it over a public source for nothing.

Finding the right series. Across thirty providers with different names for the same thing, knowing that a series exists and where is most of the difficulty — the problem OpenBB was built on, and its server inherits the answer.

Orchestrating several tools into one question, which nobody writes a script for because every instance is one-off. And writing the query, which against a provider you have used twice is the difference between doing the work and not bothering.

All four have one shape: the model navigates and assembles, something else is the authority on the number.

What you can do about it

Read your data licence first, searching for "display", "non-display", "redistribute", "derived" and "device". Silence about AI is the common case, and is not permission.

Ask your vendor in writing, specifically. Whether a hosted model provider may receive the data, whether retrieval into a vector store is permitted, whether output shown to a client is redistribution, how devices are counted when the consumer is a process.

Prefer a server you host for anything licensed — the version where the key and the entitlement controls stay where you can demonstrate them. For public sources, SEC EDGAR MCP and the rest of MCP servers and AI agents sidestep it.

Treat every fetched document as untrusted, and never give an agent that reads the open web a tool that spends money or moves positions in the same session.

Verify every figure against its source before it leaves your hands. Every provider in market data APIs returns a citable record; a chat answer does not.

Keep the model out of the arithmetic. Let it write the query, the formula or the script and let something deterministic run it — which removes most of the errors attributed to models being unreliable.

Start read-only and add write access on purpose. SnapTrade's hosted server is read-only by design; QuantConnect's can deploy a live algorithm.

Then choose the server the way you choose any dependency. Everything here that ships one is at tools with MCP, and what separates them is on the category page. The subscription behind the key is the real purchase, and what research terminals are allowed to hand you is the same question one layer above it.