v1.5.0

v1.5.0 — Trade Journal tools

Your trade journal in the LuxAlgo app, over MCP: the dashboard, the P&L calendar, every trade with its fills and annotations, your notes — and the writes that keep a journal alive. Thirteen journal_* tools, all sign-in required, all acting as you on your own data. Everything else in the server is unchanged and still works anonymously.

Highlights

• Read your journal. journal_overview returns the whole dashboard for a window — performance metrics, Edge Score with its components, per-day P&L, the equity curve, open positions, accounts and settings, optionally with the previous equal-length window for comparison. journal_calendar gives a month of day cells with weekly and monthly totals; journal_breakdown slices closed trades by weekday, time of day, hold time, symbol, side, position size, tag, rating and asset class — the "where does my P&L actually come from" question.
• Drill into trades. journal_list_trades pages through summaries with account, day-window, symbol, direction, status and tag filters, sorted by opened or closed time, net or gross P&L, duration, quantity, symbol or rating. journal_get_trade returns one trade in full: every fill (what the source reported, your corrections, the effective values), per-exit P&L and all annotations. journal_get_day is a single day's stats, trades and notes.
• Write to it. journal_add_trade logs fills into a manual or import account and returns the trade they formed. journal_update_trade annotates a trade — notes, tags and mistakes (replace the list, or add/remove a few without clobbering the rest), playbook, rating, stop loss, profit target, reviewed. journal_write_note adds a note to a day; journal_update_note edits one. journal_list_tags and journal_search_notes give an agent your existing vocabulary and your notes feed so what it writes fits what is already there.
• Same security model as everything else. The server decides nothing about your data: each call forwards your OAuth token to the app's journal API, which resolves your account exactly as the web app does and owns validation and entitlements. Writes never leave the server without a token.

Using the journal tools

Sign in as for luxalgo_account — hosted connectors run the OAuth flow when a journal tool is first called; over stdio, npx -y @luxalgo/mcp login (see the README's Signing in with LuxAlgo). Two conventions the tools share:

• Start with journal_list_accounts. It returns your journal accounts and the journal timezone. Every accounts filter takes ids from this call (unknown ids are rejected, not ignored), and journal_add_trade needs a manual or import account — broker-synced accounts belong to the sync.
• Dates are day keys. from, to, date and month are YYYY-MM-DD / YYYY-MM in your journal timezone, the way the app's calendar buckets them. Open positions always count toward a window that reaches today and are always listed by journal_list_trades.

Trade keys come from journal_list_trades, journal_get_day, journal_search_notes or journal_add_trade and are the handle every per-trade tool takes. Note ids come from journal_get_day and journal_search_notes.

Added

• Trade Journal tools (journal_*, thirteen, all protected): journal_list_accounts, journal_overview, journal_calendar, journal_breakdown, journal_list_trades (with sort / order), journal_get_trade, journal_get_day, journal_list_tags, journal_search_notes, journal_add_trade, journal_update_trade, journal_write_note, journal_update_note — via the app's `/api

v1.4.1

v1.4.1

Internal restructure and agent documentation. No change to tool names, input schemas, outputs, the wire protocol, OAuth behaviour, or the luxalgo-mcp binary — a drop-in update.

Changed

• Source layout reorganised by concern. src/lib/ is gone. Each tool domain now lives in src/tools/<domain>/ behind a declarative ToolModule (index.ts lists the tool names, which are protected, and whether the module is local-only), registered once in src/server/manifest.ts. Startup asserts that every module registers exactly the tools it declares; the HTTP gate's protected-tool set and the per-tool securitySchemes hint are derived from the manifest instead of maintained by hand.
• OAuth code moved to src/auth/ (the former protected-tools.ts split into runtime, errors, instrument, protected-tool); the app HTTP client to src/platform/app-client.ts, with per-domain endpoint wrappers next to their tools; the entry points to src/entries/ (stdio, node-http, hosted).
• The 900-line simulator file is now tools/propfirms/simulation/{package-tools,shared,pass-rates,validate-strategy}.ts; the twelve duplicated json / toolError / compact helpers are one tools/_shared/.
• npm run start:http now runs dist/entries/node-http.js. dist/http.js remains as a shim, so existing node dist/http.js process managers keep working.
• Tests moved from scripts/ to test/. The smoke suite is split per domain under test/smoke/ (node test/smoke.mjs --only library,edge runs a subset) and now asserts that the advertised server version matches package.json.
• The shared guarded() result helper lets the app's 401/403 (AppAuthError / AppPermissionError) propagate to the auth wrapper instead of flattening them into a generic tool error, so tools using it still return the sign-in challenge or the plan-upgrade message.

Added

• AGENTS.md — rules and the add-a-tool recipe for AI coding agents (CLAUDE.md imports it for Claude Code).
• docs/auth.md — how OAuth, token forwarding and the public/protected tool distinction work, and what tool code may and may not do.

Full changelog: v1.4.0...v1.4.1

Sign in with LuxAlgo (OAuth 2.1), Market Trackers, Edge Stats, MCP SDK v2

Highlights

• Sign in with LuxAlgo. OAuth 2.1 with app.luxalgo.com as the authorization server and this server as an RFC 9728 protected resource. Everything that worked anonymously still does; signing in unlocks account tools, starting with luxalgo_account (plan tier, entitlements, profile basics). The server makes no entitlement decisions itself — tools forward your token to the app's API, which resolves your account exactly as the web app does.
• Market Trackers tools — the public record of US markets (congressional trades, insider filings, 13F holdings, contracts, lobbying, short volume, patents, trials, FDA events, and more) streamed from CC0 dumps, keyless, with a primary-source link on every row.
• Edge Stats tools — nightly session statistics from the open-source edge-stats engine, always with sample size and a Wilson 95% CI.
• MCP SDK v2 / protocol 2026-07-28 on all three entries (stdio, plain Node, Vercel), with the SDK's legacy fallback still answering 2025-era clients.

Signing in

Hosted connectors (ChatGPT, Claude, Cursor, mcp-remote). The server serves /.well-known/oauth-protected-resource, challenges anonymous account-tool calls with 401 + WWW-Authenticate, and declares per-tool securitySchemes in tools/list — your client runs the OAuth flow (PKCE, consent in the browser) and keeps the token. Auth is lazy: initialize and tools/list never prompt. LUXALGO_AUTH_CHALLENGE=result switches the challenge to an in-band tool error carrying _meta["mcp/www_authenticate"].

Local (stdio). The server on your machine is itself the OAuth client (authorization code + PKCE, loopback redirect, CIMD identity at /oauth/client.json, silent refresh):

npx -y @luxalgo/mcp login     # opens your browser
npx -y @luxalgo/mcp status
npx -y @luxalgo/mcp logout

Tokens are stored owner-only under your user config dir (LUXALGO_MCP_AUTH_FILE to override) and are only ever sent to the LuxAlgo app. Clients supporting URL-mode elicitation (MCP 2026-07-28) can skip the command — the first account-tool call signs in in-session.

Added

• OAuth 2.1 sign-in (see above): protected-resource metadata, offline JWT verification against the app's JWKS (issuer, audience, expiry; DPoP-bound tokens refused), lazy 401 challenges, per-tool securitySchemes, the local login/logout/status CLI, and the first protected tool luxalgo_account via the app's /api/account/me.
• Market Trackers tools: trackers_datasets, trackers_query, trackers_latest, trackers_ticker — reading LuxAlgo/market-trackers data shard by shard under a per-call byte budget.
• Edge Stats tools: edge_symbols, edge_presets, edge_report.
• New runtime dependencies: jose and @modelcontextprotocol/client. New env: MCP_RESOURCE (default https://mcp.luxalgo.com/mcp); the issuer follows the existing LUXALGO_APP_ORIGIN.
• TRADEMARKS.md, SECURITY.md, CHANGELOG.md, CODEOWNERS, and CI (build, dependency license gate, DCO check).
• Smoke suites now check the advertised securitySchemes on the wire and the unauthenticated behaviour of luxalgo_account on both transports.

Changed

• MCP SDK v2 (@modelcontextprotocol/server 2, zod 4) and the stateless 2026-07-28 protocol on all entries; tool names, schemas, and outputs unchanged, 2025-era clients still served via the SDK's per-request fallback.
• @luxalgo/prop-firm-sim-mcp 1.3.0 via its /tools and /directory entry points; parity covered by npm run test:parity.
• @luxalgo/broker-sdk ^0.5.0 (22 brokers and exchanges).
• The Vercel entry advertises the same serverInfo as the other entries; npm run typecheck now covers it; mcp-handler moved to dependencies.
• README redesigned around the LuxAlgo brand system, with a live Vela chart demo; package.json/server.json/advertised versions aligned.

Full changelog: CHANGELOG.md · npm: @luxalgo/mcp@1.4.0 · Hosted: https://mcp.luxalgo.com/mcp