ibkr-portfolio-builder-mcp

A remote MCP server for top-down portfolio construction with Interactive Brokers. Built to be used as a Claude.ai custom connector, Claude Code MCP, or any HTTP MCP client.

Most ibkr-mcp servers expose individual lookup primitives — get_quote, get_position, place_order. This one exposes the research workflow: a typed catalog of 468 screeners across 16 categories tagged by strategy intent (value / growth / income / momentum / quality / events / …), per-scan applicable instruments, inverse-pair links, and live news/account access — so an LLM can do real top-down portfolio construction (pick sectors / strategies → run scans → cross-reference with news → narrow to candidates) instead of bottoms-up ticker fishing.

Why this exists

I built this because the existing IBKR-MCP servers in the community treat IBKR as a "look-up-one-ticker" data source. That mirrors how most retail brokerage UIs work, but it's not how good portfolio construction actually happens.

A good top-down workflow looks like:

1. Macro thesis ("rates are about to fall, dividend payers should re-rate") →
2. Strategy intent ("show me income screens with quality bias on US large caps") →
3. Screener composition (run dividend yield + ROE + low debt screens; intersect) →
4. Event/news context ("any of these have earnings in the next two weeks? any negative analyst actions?") →
5. Narrow candidate set ("five tickers, ranked by my criteria, ready for deeper diligence").

To do that with an LLM, the MCP server needs to expose the research vocabulary, not just the raw API. That's the gap this server fills:

• A typed scan catalog — 468 IBKR scan codes across 16 categories (Fundamentals, Price Movement, Dividends, Options & Volatility, Events & Earnings, 52/26/13 Week High-Low, ESG, Bonds, …) auto-tagged with 28 strategy intent tags (value, growth, quality, income, momentum_up, momentum_down, analyst, technical, gap, volatility, events, leverage, efficiency, risk_adjusted, …). The LLM asks "what value scans exist for US stocks?" and gets a clean, filterable answer instead of trying to guess scan codes from training data.
• Inverse pair links — every HIGH_X ↔ LOW_X and X_ASC ↔ X_DESC pair is precomputed, so the LLM can flip polarity ("what's the opposite of LOW_PE_RATIO?") without guessing.
• Per-scan instrument map — the catalog knows which scan applies to STK, ETF, OPT, BOND, etc. The LLM stops sending Refinitiv scans to bond instruments and getting empty results.
• Filter catalog — separate typed map of the numeric filters (priceAbove, peRatioBelow, divYieldAbove, growthRateAbove, avgVolumeAbove, marketCapAbove, …) grouped by category, with per-instrument applicability notes.
• News + screeners in one tool surface — same connector, same auth, same conversation. The LLM can intersect a scan result with recent headlines or upcoming earnings without context-switching.
• Two auth modes — full OAuth 2.1 (DCR + PKCE + well-knowns) for Claude.ai custom connectors, plus a static bearer token for everything else. Same server, same tools.

It's still an early server. The IBKR API has plenty of restrictions on what a paper account can actually see (notably historical news entitlement). But the catalog and workflow shape are production-ready, and they're the load-bearing piece for an LLM-driven research loop.

Quick facts

• Transport: Streamable HTTP at /mcp.
• Auth: OAuth 2.1 (PKCE + RFC 7591 Dynamic Client Registration) AND/OR static bearer token. Selectable via AUTH_MODE.
• Persistence: in-memory only today (sessions / DCR clients / OAuth tokens reset on container restart). Redis is on the roadmap — see below.
• IBKR connection: ib-gateway (ghcr.io/gnzsnz/ib-gateway:stable) runs as a sibling service in this compose; paper account in read-only API mode by default.
• Built on: FastMCP + ib_async.

Tools

Parity with IBKR's official MCP for the 9 read-only tools (skipping the two write/order-instruction tools — see roadmap), plus the 5 screener/news/catalog tools that are this server's reason for existing.

Note on order placement. IBKR's official MCP also exposes Create Order Instruction and Delete Order Instruction. This server intentionally does not — it runs ib-gateway in READ_ONLY_API=yes mode so even a misrouted tool call cannot place an order. Order execution belongs in a separate service with its own approval gate. See the roadmap for a possible "staged-only" instruction tool that would write to a local store without ever touching IBKR.

Authentication

AUTH_MODE selects which mechanisms the server accepts. The default is both.

The OAuth endpoints (/authorize, /token, /register, /.well-known/*, /login) are always registered. In bearer mode they're inert — nothing in your README needs to point at them.

Generating secrets

uv run --no-project python -c "import secrets; print(secrets.token_urlsafe(48))"   # bearer token
uv run --no-project python -c "import secrets; print(secrets.token_urlsafe(48))"   # session secret

Using the static bearer token

curl -X POST https://YOUR.DOMAIN/mcp \
  -H "Authorization: Bearer $STATIC_BEARER_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Connecting from Claude.ai (OAuth)

Settings → Connectors → Add custom connector → URL: https://YOUR.DOMAIN/mcp → leave OAuth client id/secret blank (Claude.ai uses DCR). When Claude.ai opens the OAuth flow, you'll be prompted for LOGIN_PASSWORD.

Run

cp .env.example .env
# edit .env: set TWS_USERID / TWS_PASSWORD (paper account), LOGIN_PASSWORD, STATIC_BEARER_TOKEN, PUBLIC_BASE_URL
docker compose up -d

By default this pulls the published multi-arch image from GitHub Container Registry: ghcr.io/adwiteeymauriya/ibkr-portfolio-builder-mcp:latest. To build locally instead (e.g. when iterating on the source), run docker compose build ibkr-mcp first.

ib-gateway takes ~60–90 s to finish IBKR login after first start. Tail logs with docker logs -f ibkr-mcp-gateway.

For local-only use (bearer-token clients, no Claude.ai) this is enough — http://localhost:8000/mcp is now serving. Claude.ai custom connectors require an HTTPS URL on the public internet, so a reverse proxy with TLS in front is needed.

Putting TLS in front for Claude.ai

Pick one. Both end with a working https://your-host/mcp and a valid cert.

Option 1 — Cloudflare Tunnel (no public IP, no port forwarding). Best if the server runs on a home network or a VM behind NAT. Cloudflare gives you a hostname and TLS for free; the tunnel daemon dials out from the server to Cloudflare's edge.

# One-time: install cloudflared, then
cloudflared tunnel login
cloudflared tunnel create ibkr-mcp
cloudflared tunnel route dns ibkr-mcp ibkr-mcp.your-domain.com

~/.cloudflared/config.yml: