Avanza MCP

Independent local Streamable HTTP MCP server for Avanza authentication, account data, instruments, market data, and orders. It uses the unofficial avanza-api package. Order tools can affect real money, so keep MCP approval enabled and use AVANZA_MCP_ALLOWED_ACCOUNT_ID when authenticated.

[!WARNING] This is an unofficial community project. It is not affiliated with, endorsed by, or supported by Avanza Bank AB. Avanza does not provide an official public API for this integration, so endpoints may change without notice. You are responsible for complying with Avanza's terms and for every action performed through your account.

Setup and run

uv sync --extra test
Copy-Item .env.example .env
uv run python -c "import secrets; print(secrets.token_urlsafe(32))"
uv run avanza-mcp-http

Paste the generated random value into AVANZA_MCP_BEARER_TOKEN in .env before starting the server. Tokens shorter than 32 characters and the published example placeholder are rejected.

The endpoint is http://127.0.0.1:8765/mcp by default. Public market-data tools work without Avanza login credentials; the local MCP bearer token is always required. See docs/tool-matrix.md for risk classifications.

Keep the server bound to localhost. Do not expose it directly to the public internet, reuse the bearer token elsewhere, or commit credentials. Tools that place, edit, or cancel orders can affect real money and should always require interactive MCP approval.

Money-affecting tools are blocked even after login unless both AVANZA_MCP_ENABLE_LIVE_TRADING=true and AVANZA_MCP_ALLOWED_ACCOUNT_ID=<account-id> are configured. Keep live trading disabled for read-only account access. The tools also publish standard MCP read-only and destructive annotations so compatible clients can apply their normal approval policies.

Environment ownership

This project exclusively owns all AVANZA_* variables shown in .env.example. Never commit .env.

Tests

uv run pytest

Tests use mocked clients and do not place orders.

Contributing and security

See CONTRIBUTING.md before submitting changes. Report security issues according to SECURITY.md, never in an issue that contains credentials, account data, or bearer tokens.

License

MIT. See LICENSE.