What Is an MCP Server for Markets?

A chat endpoint answers. An agent acts.

Most people meet a language model through a chat box. You type, it replies, the transcript ends. That loop is useful for drafting and explaining, but it is a dead end for investing, because the model has no live prices, no access to the latest 10-K, and no way to place an order. It is reasoning in a vacuum about a world that changed since its training cutoff.

An agent is different in one specific way. It can call tools. Between the question and the answer, it can fetch a quote, pull a filing, run a screen, and, when you approve, route an order to your broker where that broker supports it. The reasoning is the same language model. What upgrades it from a talker to a doer is a structured set of functions it is allowed to invoke, and a protocol for invoking them.

That protocol is where the Model Context Protocol, or MCP, comes in. A markets MCP server is the API layer that turns a general model into an investing agent. If you are building in this space, the server is the product surface that matters, more than the prompt and more than the model choice.

What MCP actually is

MCP is an open standard, introduced by Anthropic in November 2024, for connecting AI applications to external tools and data. It uses a client-server design. The client lives inside the AI application. The server exposes three kinds of capabilities: tools, which are functions the model can call; resources, which are file-like data the model can read; and prompts, which are reusable templates that shape how the model uses a tool.

The point of the standard is to kill the N-times-M integration problem. Before MCP, every agent needed a bespoke connector for every data source. Implement MCP once and the agent unlocks an entire ecosystem. Adoption has been fast: within roughly a year the community shipped thousands of servers, SDKs cover every major language, and, per Anthropic, other major model providers adopted the protocol too. It is becoming the USB-C port for AI tools.

For a builder, the mental model is simple. Your agent is the host. A markets MCP server is a plug. Speak the protocol and you inherit prices, filings, screens, and routing without hand-rolling each one.

Why an investing agent needs tools, not a bigger prompt

There is a tempting shortcut: stuff everything the model needs into the prompt. Paste in a price table, a filing excerpt, a watchlist, and let the model reason over it. This breaks in three ways that matter for money.

First, freshness. Prices move by the second and filings drop without warning. A prompt is a snapshot, and a stale snapshot is worse than none when a position is on the line. A tool call fetches the state of the world at the moment of the decision.

Second, verifiability. When a model asserts a number from its own memory, you cannot check where it came from. When it calls a prices tool and a filings tool, every figure has a provenance you can inspect and audit. That is the difference between a plausible sentence and a defensible one.

Third, action. A prompt cannot place a trade. Only a tool can carry an instruction out to a broker. If the agent is ever going to do more than narrate, it needs a routing tool with real permissions and real limits. The research literature agrees on the direction of travel. Work such as the arXiv paper Robo-Advisors Beyond Automation and ACM studies on LLM agents for investment management frame the next generation of advice as tool-using agents, not smarter chatbots.

What a markets MCP server exposes

A serious markets server is not one endpoint. It is a small, opinionated toolbox, where each tool does one thing well and returns structured, citable output. Four categories carry most of the weight.

Prices and market data. Real-time and historical quotes, fundamentals, and reference data across equities, ETFs, and crypto. This is the agent's live feed. Every valuation, every screen, every rebalance calculation grounds out here.

Filings and disclosures. Programmatic access to 10-Ks, 10-Qs, 8-Ks, and institutional holdings. This is how an agent reads what a company actually said, rather than paraphrasing a half-remembered summary. Retrieval plus citation turns a filing into evidence.

Verdicts and analysis. Higher-order tools that synthesize the raw data into a judgment: a screen, a risk read, a comparison, a proposed allocation. This is where the agent earns its keep, moving from data to a plain-English recommendation a person can weigh.

Routing and execution. The tool that carries an approved instruction out to a broker. This is the one with teeth, and the one that demands the most guardrails: identity, limits, consent, and a kill switch. A markets MCP server that stops at read-only is a research tool. One that can route, under human approval and only where the broker supports it, is an agent.

How Tengu treats the server as the product

Tengu is AI for investing, and it ships two front doors onto the same engine. One is the consumer app. The other is an API and MCP server for builders. The design principle is identical across both, and it maps cleanly onto the four verbs that define an agent.

Find. The agent reads across every connected account, banks, brokerages, and crypto, to see a whole net worth rather than one silo. Explain. It puts each opportunity in plain English, so the reasoning is legible, not a black box. Propose. It drafts the specific move. Route. It sends that move to your broker the moment you approve, at brokers where Tengu supports execution.

The consent model is the load-bearing part. Tengu is non-custodial. You keep your accounts and your broker, you approve every move, and you hold a kill switch. For agentic workflows, you hire agents that trade only inside limits you set: a maximum per trade, a drawdown ceiling, a defined universe. For a builder wiring this into their own product through MCP, those same guardrails travel with the tools. The routing tool will not act without an approval, by design.

Citations are the trust layer

An investing agent that cannot show its work is a liability. The fix is not a better disclaimer. It is provenance built into the tool output.

When a markets MCP server returns a price, it should return the source and timestamp. When it returns a line from a filing, it should return the document, the section, and a link. When it returns a verdict, that verdict should trace back to the specific data points that produced it. This is how you keep a probabilistic model honest: not by trusting the sentence, but by checking the citation underneath it.

This matters commercially, not just ethically. Deloitte's Center for Financial Services projects that generative AI could become a leading source of retail investment advice as early as 2027, reaching roughly 78 percent adoption by 2028. Advice at that scale only holds up if every claim is auditable. Fortune, writing in 2026, dismissed the last generation of robo-advisors as a generic, incremental feature at best. The upgrade that separates a real agent from a repackaged robo-advisor is exactly this: tool-grounded, cited outputs a user and a regulator can both inspect.

A concrete example: cross-account tax-loss harvesting

Consider a task that is hard for a chatbot and natural for a tool-using agent: harvesting tax losses across accounts. It needs live prices, position data from multiple brokers, tax rules, and the ability to propose paired trades. That is four tools in one workflow.

The agent reads positions across every connected account, checks current prices, and finds lots trading below cost basis. It proposes selling to realize the loss and, critically, respects the IRS wash-sale rule under Section 1091: if you buy the same or a substantially identical security within 30 days before or after the sale, the loss is disallowed. A cross-account view is essential here, because the rule spans all your accounts, including an IRA, not just the one you sold in. A single-broker tool cannot see the violation coming.

The agent explains the trade in plain English, proposes the specific pair, and routes it only when you approve. Every number in that proposal, the basis, the price, the 30-day window, carries a citation. That is the whole thesis in one workflow: tools for freshness and action, citations for trust, and consent at the trigger.

What to build, and what to demand

If you are building an investing agent, start with the server, not the persona. Decide which tools you expose, what each returns, and how provenance is attached. A thin chat wrapper over a model will feel smart for a week and then hallucinate a price into someone's portfolio.

If you are choosing an agent or an API to build on, demand three things. Live tools, not a static context dump. Cited outputs, so every figure traces to a source. And consent at the point of action, so nothing routes to your broker without your approval and your kill switch. The World Economic Forum's work on agentic AI in financial services lands on the same requirements: capability paired with control.

This is education, not investment advice, and none of it promises a return. But the architecture is settled. The agents that matter will be defined by their tools, kept honest by their citations, and bounded by human consent. The markets MCP server is where all three of those live.