J-Quants MCP

jquants-mcp

English | 日本語

An MCP (Model Context Protocol) server that retrieves Japanese stock market data via J-Quants API v2.

User-facing documentation site: https://shigechika.github.io/jquants-mcp/ (also available in 日本語) — start there if you want a gentler 5-minute introduction. This README is the technical reference (config schema, all 55 tools with parameter tables, deployment).

Release history and changelog: GitHub Releases.

Deployment shapes and how to pick between them: see docs/deploy/.

Demo

24-second loop showing real output from the Claude iPhone app calling jquants-mcp tools:

• Sector performance ranking (業種別騰落率) — get_sector_performance
• Top turnover by trading value (売買代金ランキング) — get_top_turnover_value
• Candlestick chart with SMA — get_candlestick_data
• Quarterly financial summary (決算ダイジェスト) — get_fins_summary
• 5-stock return comparison — get_comparison_chart_data

Individual frames are in docs/screenshots/.

Features

• 55 MCP tools — 22 J-Quants API v2 endpoints, 11 market overview + valuation, 10 offline screener, 1 technical indicators, 1 single-stock summary, 3 cache-only equity search + earnings (schedule + results), 2 chart tools (JSON, no optional dependencies), and 5 server utilities
• Two-tier SQLite cache — row-level cache for time-series data, response-level cache with TTL for others
• Stock split detection — automatic cache invalidation when AdjFactor changes
• Rate limiting — plan-aware sliding window (Free: 5/min, Light: 60, Standard: 120, Premium: 500)
• Retry with backoff — automatic retry for 429/5xx errors
• Pagination — transparent multi-page fetching
• Plan-aware — all tools registered regardless of plan; graceful error messages on restriction

Requirements

• Python 3.10+
• J-Quants API key (Free plan or above)

Installation

# Using uv (recommended)

uv pip install jquants-mcp

Using pip

pip install jquants-mcp

From source

git clone https://github.com/shigechika/jquants-mcp.git

cd jquants-mcp uv sync --dev

Configuration

Settings are loaded with the following priority (later wins):

1. ~/.jquants-api/jquants-api.toml — API key only (J-Quants official config)
2. ~/.config/jquants-mcp/config.ini (user global)
3. ./config.ini (current directory)
4. Environment variables (from MCP client or shell)

API Key (zero-config)

If you already use jquants-api-client, your API key is automatically read from ~/.jquants-api/jquants-api.toml. No extra configuration needed.

API Key via browser login

jquants-mcp login

Opens a browser to J-Quants (AWS Cognito, PKCE flow), and on success writes the API key to ~/.config/jquants-mcp/config.ini (mode 0600). Same auth backend as the official jquants-cli. Use jquants-mcp logout to clear the saved key.

config.ini

MCP-specific settings (cache, client behavior):

[jquants]

cache_dir = ~/.cache/jquants-mcp

base_url = https://api.jquants.com/v2

[client]

max_retries = 5

retry_base_delay = 1.0

max_pages = 10

[server]

encryption_key = # enables per-user API key storage (multi-user mode)

allowed_emails = alice@example.com,bob@example.com

Environment Variables

\* API key is auto-detected from ~/.jquants-api/jquants-api.toml. Set JQUANTS_API_KEY only to override.

Environment variables override both config.ini and jquants-api.toml. This allows MCP clients (Claude Desktop, Claude Code, Codex, …) to pass settings via their env block while keeping defaults elsewhere.

macOS launchd note

If you run jquants-mcp as a macOS LaunchAgent and the API key lives in ~/.jquants-api/jquants-api.toml, the server may silently hang during startup on macOS 26 or later. The TCC sandbox applied to launchd-spawned processes blocks open() on some dotfiles under $HOME (mode 600), and the process never finishes starting.

Workaround: copy the toml outside the sandboxed home hierarchy and point the server at it via JQUANTS_API_TOML_PATH:

sudo mkdir -p /usr/local/etc/jquants-mcp

sudo cp ~/.jquants-api/jquants-api.toml /usr/local/etc/jquants-mcp/jquants-api.toml sudo chown "$USER":staff /usr/local/etc/jquants-mcp/jquants-api.toml sudo chmod 600 /usr/local/etc/jquants-mcp/jquants-api.toml

Then add the following to your LaunchAgent plist's EnvironmentVariables dict:

<key>JQUANTS_API_TOML_PATH</key>

/usr/local/etc/jquants-mcp/jquants-api.toml

Alternatives: set JQUANTS_API_KEY directly in the plist (simpler but puts the key in a plist file that Time Machine / iCloud may back up), or put api_key = directly in ~/.config/jquants-mcp/config.ini (if that path is not sandbox-blocked on your macOS version).

Linux/systemd and other init systems are not affected.

Authentication

The server speaks stdio only and binds no network socket, so it performs no authentication of its own — there is no listener to authenticate against. Access control is a property of whoever starts the process:

Gateway identity

For remote or multi-user deployments, put a gateway in front of the stdio server. mcp-stdio serve is the gateway both production deployments use: it accepts MCP over HTTP, authenticates the caller, and spawns one jquants-mcp child process per session.

The gateway passes the authenticated identity down to that child as the JQUANTS_MCP_USER environment variable (mcp-stdio serve --trusted-user-header X-Forwarded-Email --user-env JQUANTS_MCP_USER). One child process serves exactly one principal for its whole lifetime, and the server reads JQUANTS_MCP_USER as that principal's verified email — it applies the JQUANTS_ALLOWED_EMAILS allowlist and per-user rate limits to it, and looks up that user's stored API key.

Trust model: JQUANTS_MCP_USER is trusted as-is; the server does no verification of its own. Whoever can set the child process's environment *is* that user, so the variable must be injected by the gateway and never by a user-supplied value.

When JQUANTS_MCP_USER is absent — the normal local case — the server runs single-user against the globally configured API key.

A worked example of the whole shape (auth proxy in front, gateway, stdio child, cache download) is scripts/entrypoint-stdio.sh, the entrypoint of the Cloud Run deployment described below. There is no other documented remote-access story: the server itself has no transport, TLS, or token options.

Multi-user Mode

When the server receives a gateway identity (JQUANTS_MCP_USER, see Authentication) and MCP_ENCRYPTION_KEY is configured, it operates in multi-user mode: each user stores their own J-Quants API key on the server, and all data tools use that key automatically. All users share the read cache; each user gets an independent J-Quants client with isolated rate limiting and their own plan's date-range window.

User flow

sequenceDiagram

participant U as User participant C as MCP client participant G as Gateway (mcp-stdio serve) participant S as jquants-mcp (stdio child) participant J as J-Quants API U->>C: Connect C->>G: Authenticate (gateway's own auth layer) G->>S: Spawn child with JQUANTS_MCP_USER = verified email U->>C: "Register my J-Quants API key: " C->>G: register_api_key(api_key=" ") G->>S: forward over stdio S->>J: Probe plan-specific endpoints (auto-detect) J-->>S: Detected plan S->>S: Encrypt & store key + plan (AES-256-GCM) S-->>C: {"status": "ok", "plan": " "} U->>C: "Get TOPIX daily prices" C->>S: get_indices_bars_daily_topix(...) S->>J: API call with user's key J-->>S: Data S-->>C: Result

Tools for multi-user mode

Both tools return an explanatory error instead of failing silently when either requirement is missing.

Registering a key (tell your AI agent):

"Register my J-Quants API key: "

The agent calls register_api_key(api_key="..."). The server probes plan-specific endpoints with the key to auto-detect the plan (free / light / standard / premium) and stores it alongside the encrypted key — no manual selection needed. Subsequent tool calls use the detected plan for rate limiting and date-range restrictions.

This is the only way to register a key on a multi-user deployment; the server exposes no web form and no HTTP endpoint of any kind.

Security

• API keys are encrypted with AES-256-GCM (authenticated encryption — integrity-protected)
• The encryption key is derived via PBKDF2-HMAC-SHA256 (200,000 iterations) from MCP_ENCRYPTION_KEY, with a random 16-byte salt per encryption
• Each ciphertext uses a unique random 12-byte nonce — encrypting t