tossinvest-cli — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Recheck a specific changing behavior of github.com/JungHoonGhae/tossinvest-cli: Has the unofficial broker interface changed, and are live trade tool defaults and legal/terms boundaries appropriately qualified?

Reviewed Oct 9, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Korean brokerage data and account operations

What we know

Unendorsed Toss Securities CLI exposes an MCP mode including read and live order operations.

Maintenance / activity evidence

tossinvest-cli repository has dated feature and WTS policy commits on 2026-09-01.

Tracking evidence observed Oct 9, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: medium.

Activity source · commits ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Unofficial third-party Toss Investments client; may access sensitive investment accounts. Live trade submission disabled by default, human review/confirmation required by documented flow. Broker terms and account restrictions not independently confirmed; financial loss risk. Writes: Place live trade orders when authorized; Cancel or change supported orders.
Authentication not yet verified.
Can place real investment trades using unofficial private/internal service access; potential account loss, policy breaches and irreversible orders.

Can place real investment trades using unofficial private/internal service access; potential account loss, policy breaches and irreversible orders.
Advisory/security review not completed; no safety badge.
Unknown vulnerabilities and provider data handling are not certified by this public tracking review.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

515 repository stars

Stars observed Oct 9, 2026.

Repository total for JungHoonGhae/tossinvest-cli.

All limitations / Review context

Has the unofficial broker interface changed, and are live trade tool defaults and legal/terms boundaries appropriately qualified?

No identified material blocker to an accurately qualified public tracking entry in the limited cited evidence. This is not an installation safety certification; product-specific cautions must remain visible.

Can place real investment trades using unofficial private/internal service access; potential account loss, policy breaches and irreversible orders.
Advisory/security review not completed; no safety badge.
Unofficial third-party Toss Investments client; may access sensitive investment accounts. Live trade submission disabled by default, human review/confirmation required by documented flow. Broker terms and account restrictions not independently confirmed; financial loss risk.
Reviewed write actions: Place live trade orders when authorized; Cancel or change supported orders
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Unofficial brokerage API may break or violate platform conditions; can access financial accounts and initiate real trades. Tracking is not a recommendation to execute.
Unknown vulnerabilities and provider data handling are not certified by this public tracking review.
Release evidence proves attributable activity, not entire installation or tool-level safety.
Current Discovery source binding and atomic apply must be generated using MCP100 existing pipeline.
first-party data processing and retention
data retention and permission scope
Unofficial web internal APIs may violate terms; real buy/sell/cancel orders possible. Do not publish until risk/legal review.
Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode and do not invent unresolved facts.

Original activity observations

tossinvest-cli repository has dated feature and WTS policy commits on 2026-09-01.

Technical identity

github.com/JungHoonGhae/tossinvest-cli

Exact implementation source: https://github.com/JungHoonGhae/tossinvest-cli ↗
Reviewed resource type: MCP Server
Repository identity: JungHoonGhae/tossinvest-cli

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 9, 2026 · Latest source observation Oct 9, 2026

GitHub repository ↗
junghoonghae/tossinvest-cli
Recorded repository material and project history.
Includes references whose attribution is not established.
Evidence source ↗
tossinvest-cli.vercel.app/en/docs/guide/mcp
Source material retained for this review.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Claude Code

Publisher instructions with a documented client setup path.

Source evidence observed Oct 12, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Use the publisher-documented command or connection method below; complete the prerequisites and client configuration before expecting a usable MCP connection.
claude mcp add tossctl tossctl mcp
Configure / authenticate
Publisher instructions
After installing tossctl using the official platform installer, run tossctl auth login (or tossctl auth login --link) for the regional account authorization. Separate Toss Open API integration uses tossctl openapi login and tossctl openapi status. Register the optional stdio MCP entry in the selected client only after local CLI authentication; do not enable live orders for setup.
Check connection
MCP100 setup guide
Run tossctl doctor --report for authentication diagnostics, tossctl monitor api for a documented read-only API monitor, or tossctl account summary --output json for a read-only account query. Also inspect tossctl MCP tools in the registered client. NEVER place a real securities order to confirm connectivity. Client registration check: `claude mcp get tossctl` (checks registration; inspect tools/read-only calls separately to verify authenticated service access).
tossctl doctor --report
tossctl monitor api
Remove / uninstall / revoke
MCP100 setup guide
The publisher registers Claude Code as `tossctl` with `claude mcp add tossctl tossctl mcp`; disconnect with `claude mcp remove tossctl`. For JSON hosts delete only the `tossinvest` entry. This does not remove the local trading CLI or saved account sessions.
claude mcp remove tossctl

Official Documentation & Sources

What it does

Unendorsed Toss Securities CLI exposes an MCP mode including read and live order operations.

Capability: Finance & Payments
Resource type: MCP Server
Industry: Financial Services & Investing
Best fit: Korean brokerage data and account operations

Representative uses

Catalog mode exposes list_operations, describe_operation, call_operation

Limitations

Unofficial web internal APIs may violate terms; real buy/sell/cancel orders possible. Do not publish until risk/legal review.
Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode and do not invent unresolved facts.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Not documented in the reviewed sources
Permissions: Unofficial third-party Toss Investments client; may access sensitive investment accounts. Live trade submission disabled by default, human review/confirmation required by documented flow. Broker terms and account restrictions not independently confirmed; financial loss risk.
Data handling: Not documented in the reviewed sources
Cost: unknown
Risk and cautions: Can place real investment trades using unofficial private/internal service access; potential account loss, policy breaches and irreversible orders.

Access scope and cautions

Write actions: Place live trade orders when authorized Cancel or change supported orders
Risk level: high
Security notes: Advisory/security review not completed; no safety badge.

FAQ

Based on reviewed evidence as of 2026-10-09. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Catalog mode exposes list_operations, describe_operation, call_operation.

What setup and authentication are documented?

A complete connection procedure is not verified. Recorded transport: stdio_unverified. Client notes: Inspect the MCP tool list without submitting an order. Never smoke-test live financial transactions. These facts do not supply missing installation commands, credentials or a verified authentication procedure. Authentication: Unofficial trading-account integration; authentication follows tossctl local session.

Can it modify data or perform write operations?

Documented write actions include: Place live trade orders when authorized; Cancel or change supported orders. Recorded permission boundary: Unofficial third-party Toss Investments client; may access sensitive investment accounts. Live trade submission disabled by default, human review/confirmation required by documented flow. Broker terms and account restrictions not independently confirmed; financial loss risk.

What limitations and risks should I check before use?

Can place real investment trades using unofficial private/internal service access; potential account loss, policy breaches and irreversible orders. Unofficial web internal APIs may violate terms; real buy/sell/cancel orders possible. Risk/legal review remains necessary. Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode. Advisory/security review not completed; no safety badge. Unofficial brokerage API may break or violate platform conditions; can access financial accounts and initiate real trades. Tracking is not a recommendation to execute. Unknown vulnerabilities and provider data handling are not certified by this public tracking review.