
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A Model Context Protocol (MCP) server that provides real-time access to Taiwan Stock Exchange (TWSE) market data, financial reports, and trading analytics through Claude Desktop.
npx twse-mcp
No installation required! The server connects directly to TWSE's official API to provide comprehensive market data.
# Run directly without installation
npx twse-mcp
# Install globally
npm install -g twse-mcp
# Run the server
twse-mcp
# Clone repository
git clone https://github.com/pyang2045/twsemcp.git
cd twse-mcp
# Install dependencies
npm install
# Build and run
npm run build
npm start
Add to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"twse": {
"command": "npx",
"args": ["twse-mcp"],
"env": {}
}
}
}
Add to %APPDATA%\Claude\claude_desktop_config.json:
{
"mcpServers": {
"twse": {
"command": "npx",
"args": ["twse-mcp"],
"env": {}
}
}
}
| Tool | Description | Example Query |
|---|---|---|
getStockDaily | Daily trading data for all stocks | "Show today's stock prices" |
getStockPERatios | Valuation metrics | "Find undervalued stocks" |
getMarketIndex | Market indices (TAIEX, etc.) | "How's the market today?" |
getStockDayAvg | Daily close vs monthly average | "Show price averages" |
getMonthlyStats | Monthly trading statistics | "Get monthly highs and lows" |
searchStock | Search specific stock | "Find TSMC stock data" |
| Tool | Description | Example Query |
|---|---|---|
getMonthlyRevenue | Monthly revenue reports | "Show revenue growth" |
getIncomeStatement | Quarterly P&L statements | "Get earnings data" |
getBalanceSheet | Quarterly balance sheets | "Check debt levels" |
getIndustryEPS | EPS by industry | "Compare sector earnings" |
getProfitAnalysis | ROE, ROA, margins | "Find profitable companies" |
searchFinancials | Company-specific financials | "Get TSMC financial reports" |
| Tool | Description | Example Query |
|---|---|---|
getTop20Volume | Most traded stocks | "What's hot today?" |
getMarginTrading | Margin/short data | "Show leverage levels" |
getFiveSecondStats | Real-time bid/ask | "Get order flow" |
| Tool | Description | Example Query |
|---|---|---|
getTopForeignHoldings | Top foreign holdings | "What are foreigners buying?" |
getForeignCategoryHoldings | Foreign investment by sector | "Foreign sector preferences" |
getNewListings | Recent IPOs | "Show new stocks" |
getSuspendedListings | Delisted companies | "Which stocks were delisted?" |
getETFRanking | Popular ETFs | "Top ETF choices" |
getIndexHistory | Historical index data | "TAIEX history" |
getHolidaySchedule | Market calendar | "When is market closed?" |
You: "How's the Taiwan stock market doing today?"
Claude: [Uses getMarketIndex to show TAIEX and major indices]
You: "What are the most active stocks?"
Claude: [Uses getTop20Volume to display top traded stocks]
You: "Analyze TSMC's financial performance"
Claude: [Uses searchFinancials("2330", "income") for earnings]
[Uses searchFinancials("2330", "balance") for financial position]
[Uses searchFinancials("2330", "profit") for profitability metrics]
You: "Find high dividend yield stocks"
Claude: [Uses getStockPERatios to filter for high dividend yields]
You: "Show me what foreign investors are buying"
Claude: [Uses getTopForeignHoldings for top 20 foreign picks]
Search for specific stock data:
{
"query": "2330", // Stock code or name
"dataType": "daily" // "daily" | "peratio" | "monthly"
}
Search company financial reports:
{
"stockCode": "2330", // Company stock code
"reportType": "income" // "revenue" | "income" | "balance" | "profit"
}
# Install dependencies
npm install
# Development mode (with hot reload)
npm run dev
# Build for production
npm run build
# Run tests
npm test
twse-mcp/
├── src/
│ ├── index.ts # MCP server implementation
│ └── api/
│ └── twse-client.ts # TWSE API client
├── dist/ # Compiled JavaScript
├── bin/ # CLI executable
└── examples/ # Configuration examples
All tools return JSON data with Traditional Chinese field names:
{
"公司代號": "2330",
"公司名稱": "台積電",
"收盤價": "595.00",
"本益比": "25.83",
"殖利率": "2.02"
}
Contributions are welcome! Please see our Contributing Guide for details.
git checkout -b feature/amazing-feature)git commit -m 'Add amazing feature')git push origin feature/amazing-feature)MIT License - see LICENSE file for details
FAQs
MCP server for Taiwan Stock Exchange (TWSE) market data API
We found that twse-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.