Questrade MCP Server

An MCP server for the Questrade trading API. Use it from MCP-compatible clients (Claude, ChatGPT, Cursor, and others) to inspect portfolio data, quotes, market history, orders, and account activity.

This server is designed around outcome-oriented tools: each tool performs the necessary Questrade API orchestration internally so agents can get complete results with fewer round-trips.

Quick Start
MCP Features
Tools
Configuration
Token Management
Real-Time Data Notes
Development Setup
Project Structure
Docker
CI/CD
Security
Contributing
Security Policy
Release Process
License

Quick Start

Prerequisites

Node.js 22+
A Questrade account with API access enabled

1) Clone, Install, Build

git clone https://github.com/DrWheelicus/questrade-mcp-server.git
cd questrade-mcp-server
npm install
npm run build

2) Get a Questrade Refresh Token

Open the Questrade API Hub
Register a personal app (or reuse an existing one)
Enter a name for the device and a description
Click Create
Select New device
Select Generate new token
Copy the refresh token and paste it into the .env file

[!WARNING] The refresh token is a secret and should not be shared. If you lose it, you will need to generate a new one. (Steps 5-7)

3) Add Server to Your MCP Client

Use a config like this (replace with your local absolute path):

{
  "mcpServers": {
    "questrade": {
      "command": "node",
      "args": ["/absolute/path/to/Questrade/dist/index.js"],
      "env": {
        "QUESTRADE_REFRESH_TOKEN": "<your-token>"
      }
    }
  }
}

Common locations:

Claude Desktop: ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows)
Claude Code: project .mcp.json or ~/.claude/mcp.json
Cursor: Settings -> MCP Servers

[!NOTE] On some Windows MSIX installs, Claude Desktop may read a virtualized config path instead: %LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json.

4) Verify

Restart your MCP client and ask:

Show me my portfolio

MCP Features

Tools: purpose-built portfolio and market data operations
Transport support: stdio for local clients, Streamable HTTP for remote clients
Validation: tool inputs validated with Zod schemas
Token lifecycle management: encrypted persistence and automatic refresh

This server currently exposes MCP tools (not prompts/resources).

Tools

| Tool | Description | | ---- | ----------- | | getPortfolio | Full portfolio overview across accounts with positions and balances | | getPositions | Positions held in a specific account | | getBalances | Cash balances and buying power for an account | | lookupSymbol | Search by ticker/name and return symbol details plus live quote | | getQuotes | Batch Level 1 quotes by ticker names or symbol IDs | | getPriceHistory | Historical OHLCV candles at intervals from 1 minute to yearly | | getOrders | Order history with state and date filters | | getAccountActivity | Combined activities and executions timeline |

Configuration

All runtime configuration is environment-driven:

| Variable | Required | Default | Description | | -------- | -------- | ------- | ----------- | | QUESTRADE_REFRESH_TOKEN | Yes (first run) | - | OAuth refresh token from Questrade | | QUESTRADE_ENVIRONMENT | No | production | production or practice | | QUESTRADE_MCP_TRANSPORT | No | stdio | stdio or http | | QUESTRADE_MCP_PORT | No | 3100 | Port for HTTP transport | | QUESTRADE_ENCRYPTION_KEY | No | machine-derived | Override encryption key for token storage | | LOG_LEVEL | No | info | fatal, error, warn, info, debug, trace |

The CLI flag --transport overrides QUESTRADE_MCP_TRANSPORT.

HTTP Mode (Remote Clients)

QUESTRADE_REFRESH_TOKEN=<your-token> node dist/index.js --transport=http

Server endpoint:

http://localhost:3100/mcp

Token Management

Questrade uses single-use refresh tokens. This server:

Exchanges the initial refresh token on first startup
Encrypts and stores token material with AES-256-GCM
Renews access proactively before expiry
Retries once on 401 responses after refreshing

Token storage paths:

| Platform | Path | | -------- | ---- | | Windows | %APPDATA%\questrade-mcp\token.enc | | macOS | ~/Library/Application Support/questrade-mcp/token.enc | | Linux | ~/.config/questrade-mcp/token.enc |

After first successful startup, QUESTRADE_REFRESH_TOKEN is only needed again if the cached token expires.

Real-Time Data Notes

Questrade requires a paid market data subscription for real-time quotes. Without one, getQuotes returns snap quotes with daily exchange limits and may fall back to delayed data. Use isDelayed in quote responses to detect this.

Development Setup

npm install
npm run dev
npm run build
npm run lint
npm run typecheck
npm test

MCP Inspector

npx @modelcontextprotocol/inspector node dist/index.js

Project Structure

.
├── src/
│   ├── index.ts                # Server entrypoint and transport selection
│   ├── server.ts               # MCP server and tool registration
│   ├── config.ts               # Env/config parsing
│   ├── log.ts                  # Logger setup
│   ├── auth/                   # Token persistence and refresh
│   ├── client/                 # Questrade API client and rate limiting
│   ├── tools/                  # MCP tool implementations
│   ├── transports/             # stdio and HTTP transport handlers
│   └── types/                  # Shared API/domain types
├── tests/                      # Unit/integration tests
├── .github/workflows/          # CI/CD workflows
└── Dockerfile

Docker

Build and run HTTP transport:

docker build -t questrade-mcp .
docker run -p 3100:3100 -e QUESTRADE_REFRESH_TOKEN=<your-token> questrade-mcp

CI/CD

CI on push/PR to main: type check, lint, build, tests, npm audit, dependency review
CD on tags matching v..*: multi-arch Docker image to GHCR and GitHub Release

Security

Token material encrypted at rest (AES-256-GCM)
Refresh tokens rotated by design (Questrade behavior)
Token values redacted from logs
Read-only server scope (no trade placement tools)
Input validation on all tool parameters (Zod)
HTTP transport uses per-client session isolation
Docker image runs as non-root user

Contributing

See CONTRIBUTING.md for contributor setup, quality checks, and PR process.

GitHub issue and PR templates are provided in .github/ to keep reports and reviews consistent.

Security Policy

See SECURITY.md for how to report vulnerabilities privately.

Release Process

See RELEASE.md for the tag-based release checklist and verification steps.

License

No permission is granted to copy, modify, redistribute, sublicense, or use this code except with explicit written permission from the copyright holder.

Questrade MCP Server