What is etoro-mcp CLAUDE.md?

Project-specific instructions for a self-hosted, read-only MCP connector to eToro portfolio data. eToro is an investment platform; the connector covers data such as positions, profit and loss, balances, watchlists, and closed trades.

Implementing or maintaining portfolio-data lookups, validating inputs, and deploying the connector without adding trade, transfer, or other write operations.

They enforce a strict read-only boundary and document separate authentication requirements and API quirks, reducing the risk of accidental trading or unsafe requests.

How dimaKudr/etoro-mcp configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to dimaKudr/etoro-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/dimaKudr/etoro-mcp/main/CLAUDE.md

Clone the repo

git clone --depth 1 https://github.com/dimaKudr/etoro-mcp

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/instructions/dimakudr/etoro-mcp/claude-md/github.svg)](https://agentmods.dev/instructions/dimakudr/etoro-mcp/claude-md)

Your own site

<a href="https://agentmods.dev/instructions/dimakudr/etoro-mcp/claude-md"><img src="https://agentmods.dev/badge/instructions/dimakudr/etoro-mcp/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/instructions/dimakudr/etoro-mcp/claude-md"><img src="https://agentmods.dev/badge/instructions/dimakudr/etoro-mcp/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 860 This file is loaded in full into every session.

When invoked 860 The same file — it is already loaded in full.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00860	$0.00860
Opus 5	$0.00430	$0.00430
Sonnet 5	$0.00172	$0.00172
Haiku 4.5	$0.00086	$0.00086

Measured 8d ago against content hash a1e6a235fe2a, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

etoro-mcp CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 67 lines

How it starts

The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.

etoro-mcp

Personal, self-hosted, read-only MCP connector exposing eToro portfolio data (positions, P&L, balances, watchlists, closed trades) as tools for Claude's custom connector feature (claude.ai web/mobile, not just an editor).

Hard scope boundary — do not relax

Read-only. No trading. Only GET requests against eToro's API may ever appear in this codebase. No order-placement, position-close, or fund-transfer code path — not even scaffolded, stubbed, or commented out.

This is enforced structurally, not just by convention:

EtoroClient.get() in src/etoro-client.ts hardcodes method: "GET" — there is no generic request(method, ...) helper. Do not add one.
ETORO_ENDPOINTS in src/etoro-client.ts is a fixed, literal-string allow-list. Tool inputs (dates, instrument IDs) are validated/bounded in src/tools/validation.ts and never used to construct arbitrary paths or unbounded query params.
If an eToro endpoint's read/write nature is ambiguous, leave it out rather than guessing. Known write-adjacent endpoints deliberately NOT wired up: POST /watchlists, POST /watchlists/{id}/items, PUT /watchlists/setUserSelectedUserDefault/{id}, PATCH /api/v2/trading/positions/{positionId} (and demo equivalent).

If a future version ever adds trading, treat that as a deliberate, separate project with its own confirmation/safety design — not an incremental change here.

Two separate auth boundaries — don't conflate them

eToro API auth (ETORO_API_KEY, ETORO_USER_KEY) — sent as headers on every outbound eToro request, plus a fresh x-request-id UUID per request. Server-side secrets only; never returned in tool output or logged.
This connector's own HTTP auth (CONNECTOR_AUTH_TOKEN) — a bearer token required on every request to this server's /mcp endpoint, checked in src/auth.ts via a constant-time comparison (hand-rolled, since Node's crypto.timingSafeEqual isn't available without nodejs_compat on Workers). Fails closed: if CONNECTOR_AUTH_TOKEN is unset/empty, all requests are rejected (500), never silently allowed through.

Read the full file on GitHub · 67 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

8d ago First seen · 67 lines · 860 tokens per session scan A a1e6a235fe2a

Subscribe to this mod's changes

etoro-mcp CLAUDE.md is an instructions file published in the GitHub repository dimaKudr/etoro-mcp (0 stars, last pushed 17d ago), licensed MIT. It adds 860 tokens to every session, about $0.0043 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Finance and fintech

next.js AGENTS.md

AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.

vercel/next.js · 7,296 tokens

codex AGENTS.md

AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.

openai/codex · 5,153 tokens

vscode buildNext.instructions.md

Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).

microsoft/vscode · 6,785 tokens

etoro-mcp: Instructions file for Claude Code