# Financial MCP servers, and the licence behind them

MCP changes how market data reaches a model, not who may send it. The mechanism from the spec, three exchanges' published AI positions, and what breaks.

*https://stockmarketstack.com/guides/mcp-and-financial-data · background to Financial MCP Servers & AI Agents*

**Answer:** MCP is an open protocol that lets a model host call tools and read resources exposed by a server, over stdio or HTTP. It moves data into a chat window; it grants no rights to the data. Your market data agreement was written for screens and for feeds, and exchanges are now publishing AI positions that range from technology-agnostic to outright prohibition on the data they publish themselves.

Two readers arrive here. One wants the mechanism — how a language model actually gets a price, a
filing or a fundamentals series. The other wants to know whether the AI-finance tooling they keep
reading about is real.

The mechanism is real, small and unusually well specified. What it does not do is the part worth
an afternoon. **MCP changes how data reaches a model. It changes nothing about who may send it.** The
entitlement check that sat behind the terminal now sits behind the chat window, and the agreement
you signed does not know the difference.

## How it works

The Model Context Protocol connects language model applications to outside data and tools over
JSON-RPC 2.0. Its
[specification](https://modelcontextprotocol.io/specification/2026-07-28) names three roles:
**Hosts**, the applications that initiate connections; **Clients**, the connectors inside a host;
**Servers**, the services that provide context and capabilities. A chat application or an editor is
the host, holding one client per server you install. A server may offer **Resources** ("context and
data, for the user or the AI model to use"), **Prompts** ("templated messages and workflows for
users") and **Tools** ("functions for the AI model to execute"). Financial servers are almost
entirely the third.

Two standard transports are defined, and choosing between them is a licence decision before an
architectural one.
[stdio](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports) runs the server
as a subprocess the client launched, newline-delimited over its standard streams: the process is on
your machine, holding your key. **Streamable HTTP** posts each message to one HTTP endpoint,
replies arriving as a JSON object or a request-scoped SSE stream: the server is somewhere else, run
by somebody else. Semantics are identical across both.

Versions are dated, not numbered: identifiers are `YYYY-MM-DD` "to indicate the last date
backwards incompatible changes were made", and the revision current when this page was last checked
was **2026-07-28** — the string to look for in a vendor's documentation.

What a server does **not** control is most of what matters. The host decides which servers are
connected, which tools the model sees, and whether a person is asked before one is called — and the
specification is blunt that it "cannot enforce these security principles at the protocol level". It
also warns that descriptions of tool behaviour "should be considered untrusted, unless obtained
from a trusted server". A server is a wrapper with a schema and a key; every question about rights
sits upstream of it.

## Why the data industry shipped these so fast

A server over an API a vendor already runs is a weekend's work. It went out anyway because the
layer it touches — the interface, the screens, the query language — was always the replaceable one,
while the layers underneath are not:
[who owns the market data industry](https://stockmarketstack.com/guides/who-owns-market-data) maps that, and quotes an
incumbent's own words about making licensed content reachable this way.

What the server gives you over that REST API is two things, and no new data rights among them.
**Discoverability**: schemas are read at connection time, so nobody writes a client or maps
parameter names. **Orchestration**: one question can cross several tools — resolve a ticker, pull a
series, fetch the filing — with no script joining them, and the gain grows with the number of
sources rather than the quality of any one. The data still arrives under the same agreement, at the
same price, with the same restrictions afterwards.

## What the licences actually say

Your market data agreement was written for humans looking at screens and programs consuming feeds
— the display and non-display halves of nearly every exchange contract, priced differently because
a screen is countable and a process is not. A model sits between: is inference display use, because
a person reads the answer, or non-display, because a program consumed the number? Three venues have
published an answer, and they differ enough that generalising is a mistake.

**London Stock Exchange** takes the technology-agnostic line and states it in five words:
[we license the what, not the how](https://docs.londonstockexchange.com/sites/default/files/documents/lse_-_artificial_intelligence_advisory_notification.pdf).
Real-time data "must be controlled through a technical entitlement system, which permissions,
monitors and reports Data on a Unique User ID/Device ID basis"; and — the sentence with a bill
attached — where a customer cannot control data processed through an AI solution, "all Devices
technically able to access the Data are chargeable". Data "should not be consumed into any
artificial intelligence solutions which are hosted or operated by a third party unless approved".
Undated; read here on 14 September 2026.

**Cboe Global Markets** answers the display question directly, in an advisory notice under
reference ID C2026013000: use of its data in AI solutions inside a product "may require additional
licensing, such as non-display", and recipients are "solely responsible for Data Controls
governing access to Cboe Data through AI Solutions, including those hosted by third parties".
Distributing any derivative work, including
[any output of an AI Solution that can be used as a substitute for the Data](https://cdn.cboe.com/resources/market_data/2026/Guidance-Regarding-Use-of-Cboe-Data-in-AI-Solutions.pdf),
needs a separate licence.

**CME Group** goes furthest, and the scope is the part to get right. Notice DS-45 revises the
**website display** terms — the data published on CME's own site — to say that use of that
information "is strictly prohibited for any machine learning (ML), artificial intelligence (AI) or
large language model (LLM) purposes", naming training and fine-tuning, inclusion in a vector
database for retrieval-augmented generation, and automated generation of trade signals or sentiment
indicators. Effective 17 September 2026 for the agreement updates and
[1 January 2027 for the website display terms](https://www.cmegroup.com/market-data/files/market-data-license-agreement-updates-june-2026.pdf).
That is a rule about a public website rather than every licensed CME feed — and the clearest
published statement anywhere that a term written for humans has been rewritten because the reader
might be a model.

Most vendors have published nothing, and terms that predate the question do not cover it rather
than permit it. The model provider's terms belong here too, not only in the privacy conversation,
because handing licensed content to a third party is the shape of the redistribution question.
Anthropic, on a page dated 16 March 2026, says it
[will not use commercial customers' chats or coding sessions to train its models](https://privacy.claude.com/en/articles/7996885-how-do-you-use-personal-data-in-model-training)
unless they opt in. Read the equivalent page for your provider, note its date, and check it
describes the tier you are on.

## Where the data physically goes

For licensed data this is the decision, not a detail, and the documents above turn on it. A stdio
server exposes the data to exactly one third party: the model provider that has to see the tool
result to answer. A hosted server adds a second, who holds your key, sees your queries, and whose
controls you are relying on to satisfy a clause with your name on it.

Hence running your own for anything licensed. [Self-hosted tools](https://stockmarketstack.com/collections/self-hosted)
includes [OpenBB](https://stockmarketstack.com/tools/openbb), which runs locally over your own provider keys, and
[SEC EDGAR MCP](https://stockmarketstack.com/tools/sec-edgar-mcp), which reads a public source and needs no key — an underrated
reason to reach for [what is genuinely free](https://stockmarketstack.com/guides/free-financial-data-sources). Self-hosting
makes nothing private: it removes one intermediary and puts the entitlement controls where you can
show them to an auditor.

## Read-only, and the other thing

A server that reads prices and one that places orders are different risk objects, and both exist
here. [SnapTrade](https://stockmarketstack.com/tools/snaptrade)'s hosted MCP server is read-only and scoped to personal
accounts; [QuantConnect](https://stockmarketstack.com/tools/quantconnect)'s lets a model create projects, run backtests and
deploy live algorithms. Neither is wrong; not knowing which you installed is, because the failure
modes below are tolerable against a read tool and are not against a write one. The specification
expects hosts to obtain consent before invoking a tool, but cannot make them.

## What breaks, and it is specific to finance

**Fetched documents are untrusted input.** A filing, a news item or a web page is data the model
reads, and an agent that can both fetch a document and call a second tool can be steered by its
author.

**Arithmetic over tables.** Models do this badly and confidently, and a margin computed by a model
looks exactly like one from a spreadsheet.

**Point-in-time correctness.** Ask about 2019 earnings and you get the figure as it stands today,
restated, because that is what the source returns. Nothing in the protocol tells the model the
number reported at the time was different.

**No audit trail by default.** A transcript is not a record of which tool returned which figure —
which stops being an inconvenience the moment anyone regulated is involved. FINRA's 2026 oversight
report applies Rule 3110 supervision to these tools and points at
[storing prompt and output logs and tracking which model version was used and when](https://www.finra.org/rules-guidance/guidance/reports/2026-finra-annual-regulatory-oversight-report/gen-ai).

## What it is genuinely good at

Without hedging, because a page of only warnings is worth less.

**Navigating documents.** Finding the segment disclosure or the guidance paragraph in a 10-K is
exactly this. [Quartr](https://stockmarketstack.com/tools/quartr) and [BamSEC](https://stockmarketstack.com/tools/bamsec) exist because getting to the
document is the job, and [SEC EDGAR MCP](https://stockmarketstack.com/tools/sec-edgar-mcp) does it over a public source for
nothing.

**Finding the right series.** Across thirty providers with different names for the same thing,
knowing that a series exists and where is most of the difficulty — the problem
[OpenBB](https://stockmarketstack.com/tools/openbb) was built on, and its server inherits the answer.

**Orchestrating several tools into one question**, which nobody writes a script for because every
instance is one-off. And **writing the query**, which against a provider you have used twice is the
difference between doing the work and not bothering.

All four have one shape: the model navigates and assembles, something else is the authority on the
number.

## What you can do about it

**Read your data licence first**, searching for "display", "non-display", "redistribute",
"derived" and "device". Silence about AI is the common case, and is not permission.

**Ask your vendor in writing, specifically.** Whether a hosted model provider may receive the
data, whether retrieval into a vector store is permitted, whether output shown to a client is
redistribution, how devices are counted when the consumer is a process.

**Prefer a server you host for anything licensed** — the version where the key and the entitlement
controls stay where you can demonstrate them. For public sources,
[SEC EDGAR MCP](https://stockmarketstack.com/tools/sec-edgar-mcp) and the rest of
[MCP servers and AI agents](https://stockmarketstack.com/categories/mcp-ai-agents) sidestep it.

**Treat every fetched document as untrusted**, and never give an agent that reads the open web a
tool that spends money or moves positions in the same session.

**Verify every figure against its source before it leaves your hands.** Every provider in
[market data APIs](https://stockmarketstack.com/categories/market-data-apis) returns a citable record; a chat answer does not.

**Keep the model out of the arithmetic.** Let it write the query, the formula or the script and let
something deterministic run it — which removes most of the errors attributed to models being
unreliable.

**Start read-only and add write access on purpose.** [SnapTrade](https://stockmarketstack.com/tools/snaptrade)'s hosted server
is read-only by design; [QuantConnect](https://stockmarketstack.com/tools/quantconnect)'s can deploy a live algorithm.

**Then choose the server the way you choose any dependency.** Everything here that ships one is at
[tools with MCP](https://stockmarketstack.com/tools-with-mcp), and what separates them is on
[the category page](https://stockmarketstack.com/categories/mcp-ai-agents). The subscription behind the key is the real
purchase, and
[what research terminals are allowed to hand you](https://stockmarketstack.com/guides/where-research-terminals-get-their-data)
is the same question one layer above it.

## Tools this bears on

- [SEC EDGAR MCP](https://stockmarketstack.com/tools/sec-edgar-mcp.md) — SEC filings and XBRL financials as MCP tools, under AGPL or a paid commercial licence.
- [OpenBB](https://stockmarketstack.com/tools/openbb.md) — One Python API, REST app and MCP server over thirty other people's data feeds.
- [SnapTrade](https://stockmarketstack.com/tools/snaptrade.md) — One API for reading brokerage holdings and placing orders at supported brokers.
- [QuantConnect](https://stockmarketstack.com/tools/quantconnect.md) — The open-source LEAN engine, plus a hosted cloud that runs it against real brokers.

## FAQ

### What is a financial MCP server?

A small service that exposes a data source to a language model through the Model Context Protocol, usually as a set of callable tools such as "get quote" or "get filings". Almost all of them are thin wrappers over an API the vendor already published, and nearly all of them refuse to start without that vendor's API key. The server is the connector; the subscription is the purchase.

### What is the difference between MCP and a REST API?

MCP is a layer above one. A REST API is called by code you wrote; an MCP server describes its own tools in a schema the model reads when it connects, so the model can pick and chain calls without anyone writing a client. What you gain is discoverability and orchestration. What you do not gain is any right to the data that you did not already have.

### Can I connect Claude or another LLM to live stock data?

Technically, yes - a server with your provider key can hand a model live quotes. Whether you may depends on your market data agreement rather than on the tooling. Exchange agreements require entitlement controls that count and report every device able to reach the data, and several now say explicitly that those controls apply to AI systems too, including ones hosted by somebody else.

### Does sending market data to an LLM count as redistribution?

It can, and no single answer covers every contract. Cboe's advisory says that use of its data in AI solutions inside a product may require additional licensing such as non-display, and that distributing any output usable as a substitute for the data needs a separate agreement. Where your own vendor has published nothing, the terms predate the question - ask in writing and keep the reply.

### Can a language model pick stocks?

Wrong question for this page, which is about plumbing. What is documented is where models are weak — arithmetic over tables, point-in-time correctness, and treating fetched documents as instructions. FINRA's 2026 oversight report describes hallucinations as output "presented as factual information" and asks firms relying on these tools to supervise their accuracy. Everything here describes capability, not what to buy.

## Sources

1. [Specification (revision 2026-07-28)](https://modelcontextprotocol.io/specification/2026-07-28) — Model Context Protocol, 2026-07-28
2. [Transports: Overview](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports) — Model Context Protocol, 2026-07-28
3. [Versioning](https://modelcontextprotocol.io/specification/versioning) — Model Context Protocol, read 2026-09-14
4. [Use of London Stock Exchange Data in Artificial Intelligence - Guidance](https://docs.londonstockexchange.com/sites/default/files/documents/lse_-_artificial_intelligence_advisory_notification.pdf) — London Stock Exchange, read 2026-09-14
5. [Advisory Notice Regarding Use of Cboe Data in Artificial Intelligence (Reference ID C2026013000)](https://cdn.cboe.com/resources/market_data/2026/Guidance-Regarding-Use-of-Cboe-Data-in-AI-Solutions.pdf) — Cboe Global Markets, read 2026-09-14
6. [CME Data Services: DS-45 Market Data License Agreement Updates](https://www.cmegroup.com/market-data/files/market-data-license-agreement-updates-june-2026.pdf) — CME Group, read 2026-09-14
7. [How do you use personal data in model training?](https://privacy.claude.com/en/articles/7996885-how-do-you-use-personal-data-in-model-training) — Anthropic, 2026-03-16
8. [Gen AI: Continuing and Emerging Trends, 2026 FINRA Annual Regulatory Oversight Report](https://www.finra.org/rules-guidance/guidance/reports/2026-finra-annual-regulatory-oversight-report/gen-ai) — Financial Industry Regulatory Authority, read 2026-09-14

*Last updated 2026-09-14. A reference page, corrected in place — not a dated post.*