Using StockFit with AI

StockFit supports the Model Context Protocol (MCP) with OAuth 2.1 authentication. Sign in once in a browser — your AI client handles tokens automatically. No API keys to copy or rotate.

Add to your MCP config

OAuth 2.1

Same config for everyone — no API key needed. Your client opens a browser the first time you connect, you sign in, and tokens refresh automatically after that.

mcp.json

{
  "mcpServers": {
    "stockfit": {
      "type": "http",
      "url": "https://api.stockfit.io/mcp"
    }
  }
}

Connect your AI client

Each client stores MCP config in a slightly different place. Click through for the latest setup docs.

Claude Desktop

Settings → Connectors → Add custom connector

Claude Code

claude mcp add --transport http stockfit https://api.stockfit.io/mcp

Cursor

Add to .cursor/mcp.json

VS Code

Add to .vscode/mcp.json

Static API key (legacy)For scripted use, CI, or older MCP clients without OAuth

Replace YOUR_API_KEY with the token from your dashboard. This path uses mcp-remote to bridge HTTP → stdio for clients that don't yet support OAuth or HTTP transport directly.

mcp.json (legacy)

{
  "mcpServers": {
    "stockfit": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://api.stockfit.io/mcp",
        "--header",
        "Authorization: Bearer YOUR_API_KEY"
      ]
    }
  }
}

Calling the endpoint directlyTransport requirements for hand-rolled JSON-RPC clients

The server speaks the MCP Streamable HTTP transport, not plain REST. Every request must satisfy all of these, or you get the status shown:

POST https://api.stockfit.io/mcp with a JSON-RPC 2.0 body. GET returns 405 (no server-push stream is offered).
Content-Type: application/json, otherwise 415.
Accept: application/json, text/event-stream, both media types, otherwise 406. Responses arrive as a single text/event-stream event.
Authorization: Bearer <OAuth access token or API key>, otherwise a JSON 401 with a WWW-Authenticate header pointing at the OAuth metadata.
A User-Agent header. Requests without one are rejected at the edge with an HTML 403 before they reach the API.

Rule of thumb: an HTML 403 is the edge firewall, a JSON 401 or 403 is the API. The server is stateless, so no session id is required and tools/list works without a prior initialize.

No credit card. The OAuth flow uses your StockFit login.