Skills/Glama/iran-bourse-mcp

iran-bourse-mcp@r1

VERIFIED· not started

Publisher claims: "Enables AI agents to query Tehran Stock Exchange and Codal data, including quotes, order books, tick-by-tick trades, real-vs-legal money flow, shareholders, and filings, with clean analysis-ready outputs." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher msmahdinejad · publishing for 9 daysInstalls 0Last detonated 4d ago

$npx skills add iran-bourse-mcp

Watch Report an issue

Coverage

Not started: dependency install failed; the server itself was not observed.

Tested: the dependency install step · every file read, file written and host contacted by what ran
Not tested: server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: no credential variables read in the code
Where it talks to: no vendor host named in the codeAlso tsetmc.com, codal.ir, tse.ir, ime.co.ir, iee.ir, claude.com, cursor.com, visualstudio.com, windsurf.com, cline.bot, roocode.com, kiro.dev, jetbrains.com, zed.dev, opencode.ai, ampcode.com — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: server startup · the tool list · tool behavior

Connect it under the guard. Not started: dependency install failed; the server itself was not observed. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is iran-bourse-mcp@r1 safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-10 and scored it 83/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.1sprocessdependency install exit 1 ·

0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed

0.1sprocessscript backend runs setup only

0.1sprocessno install scripts to re-run

Static findings

HIGH

Hidden zero-width characters detectedsrc/iran_bourse_mcp/dates.py:201 · Hidden zero-width characters detected — may conceal contentdt.date(2026, 4, 2): "روز طبیعت (سیزده‌به‌در)",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedscripts/gen_assets.py:138 · Hidden zero-width characters detected — may conceal content

<text x="64" y="238" font-family="{SANS}" font-size="22" fill="{MUTED}" unicode-bidi="plaintext">بورس تهران، برای ایجنت‌های هوش مصنوعی</text>

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedsrc/iran_bourse_mcp/funds.py:1 · Hidden zero-width characters detected — may conceal content

"""Investment-fund universe and ranking (صندوق‌های سرمایه‌گذاری) from the exchange's own fund registry.

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedsrc/iran_bourse_mcp/screener.py:824 · Hidden zero-width characters detected — may conceal contentPreset("strong_close", "Up more than 3% and closing at the day's high", "بسته‌شدن در سقف روز",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedsrc/iran_bourse_mcp/dates.py:187 · Hidden zero-width characters detected — may conceal content(1, 13): "روز طبیعت (سیزده‌به‌در)",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedsrc/iran_bourse_mcp/screener.py:110 · Hidden zero-width characters detected — may conceal content

_f("open_interest", "num", "contracts", "موقعیت‌های باز", "Open interest of options and futures.", aliases=("buyop",)),

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedsrc/iran_bourse_mcp/funds.py:12 · Hidden zero-width characters detected — may conceal content

always 0), and ``name`` is null: the display name is ``mfName`` without the words 'صندوق سرمایه‌گذاری'.

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedscripts/tool_groups.py:20 · Hidden zero-width characters detected — may conceal content

"market_watch": "دیده‌بان کل بازار (سهام، صندوق، اوراق، اختیار، آتی)", "top_movers": "بیشترین رشد/ریزش، صف خرید و فروش، ورود پول حقیقی",

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedsrc/iran_bourse_mcp/toplists.py:1 · Hidden zero-width characters detected — may conceal content"""The exchange's own «برترین‌ها» (best-of) lists, shaped for agents.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedbenchmarks/grade.py:32 · Hidden zero-width characters detected — may conceal contentreturn str(text or "").replace("ي", "ی").replace("ك", "ک").replace(" ", "").replace("‌", "")Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedsrc/iran_bourse_mcp/server.py:142 · Hidden zero-width characters detected — may conceal content

…PS, base volume, NAV)")] = "compact", ) -> dict: """Whole-market table (دیده‌بان بازار) of the exchange's own feed: about 3,700 instruments (shares, base mar…

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedsrc/iran_bourse_mcp/text.py:43 · Hidden zero-width characters detected — may conceal contenttext = ascii_digits(text).replace("‌", "").replace(" ", "")Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedsrc/iran_bourse_mcp/server.py:252 · Hidden zero-width characters detected — may conceal content

"""Live/last quote with correct change %, volume, value, VWAP, price limits, ranges, P/E and market cap (قیمت لحظه‌ای)."""

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedsrc/iran_bourse_mcp/server.py:40 · Hidden zero-width characters detected — may conceal content

- For the exchange's own rankings (برترین‌ها: block trades, rights, ETFs, options, queues, industries) use top_lists; for who is

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedscripts/tool_groups.py:24 · Hidden zero-width characters detected — may conceal content

"index_history": "تاریخچه و روند لحظه‌ای هر شاخص", "index_constituents": "اعضای شاخص و تأثیر هر نماد", "fund_ranking": "رتبه‌بندی و مقایسهٔ صندوق‌های سرمایه‌گذاری",

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedscripts/tool_groups.py:22 · Hidden zero-width characters detected — may conceal content

"market_holder_moves": "جابه‌جایی سهامداران عمده", "supervisor_messages": "پیام ناظر", "search_symbol": "جستجوی نماد",

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedscripts/tool_groups.py:21 · Hidden zero-width characters detected — may conceal content

"industry_summary": "خلاصه گروه‌های صنعتی و ورود پول حقیقی هر صنعت", "index_contributors": "بیشترین تأثیر بر شاخص", "market_snapshot": "جدول پایان روز کل بازار",

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedsrc/iran_bourse_mcp/glossary.py:52 · Hidden zero-width characters detected — may conceal content

"شاخص هم‌وزن": {"en": "equal-weight index", "meaning": "Index where every stock has the same weight; reflects the typical stock better than the total index."},

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedsrc/iran_bourse_mcp/funds.py:42 · Hidden zero-width characters detected — may conceal content13: {"key": "project", "fa": "پروژه‌ای", "official": "پروژه‌ای", "en": ("project",)},Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedscripts/tool_groups.py:19 · Hidden zero-width characters detected — may conceal content

"market_status": "وضعیت بازار", "market_overview": "نمای کلی بازار", "indices": "شاخص‌ها و شاخص صنایع",

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedsrc/iran_bourse_mcp/server.py:125 · Hidden zero-width characters detected — may conceal content

"""All indices: total, equal-weight, free-float and every industry index with change % (شاخص‌ها و شاخص صنایع)."""

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedscripts/gen_assets.py:276 · Hidden zero-width characters detected — may conceal content

<text x="80" y="396" font-family="{SANS}" font-size="32" fill="{MUTED}" unicode-bidi="plaintext">بورس تهران، برای ایجنت‌های هوش مصنوعی</text>

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedsrc/iran_bourse_mcp/server.py:162 · Hidden zero-width characters detected — may conceal content

"""Per-industry breakdown: traded value, average and cap-weighted change, index effect, queue counts (گروه‌های صنعتی)."""

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Hidden zero-width characters detectedsrc/iran_bourse_mcp/toplists.py:129 · Hidden zero-width characters detected — may conceal content

_d("professional_investors", "stocks", T, "ProInvest:1", "بازار سرمایه‌گذاری حرفه‌ای", "Professional investors' market", COLS_MOVERS, aliases=("pro_invest",)),

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

MEDIUM

Hidden zero-width characters detectedtests/test_text.py:16 · Hidden zero-width characters detected — may conceal contentassert match_key("می‌نا") == match_key("مینا")Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

MEDIUM

Python subprocess execution detectedscripts/render_promo.py:74 · Python subprocess execution detectedsubprocess.run([ffmpeg, "-y", "-loglevel", "error", "-framerate", str(args.fps), "-i", str(frames_dir / "f%04d.png"),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscripts/gen_site_preview.py:53 · Python subprocess execution detectedsubprocess.run(cmd, check=True, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

HIGH

Hidden zero-width characters detectedsrc/iran_bourse_mcp/toplists.py:40 · Hidden zero-width characters detected — may conceal content

60: "بازار برق آزاد", 64: "بازار مصرف‌کنندگان بزرگ برق", 67: "آتی انرژی", 68: "گواهی سپرده حامل‌های انرژی", 69: "بازار برق سبز",

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

MEDIUM

Python subprocess execution detectedscripts/gen_site_preview.py:38 · Python subprocess execution detectedsubprocess.run(cmd, check=True, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Hidden zero-width characters detectedtests/test_funds.py:121 · Hidden zero-width characters detected — may conceal content

row = by_reg(fd.shape_fund_ranking({25: sample[25]}))[12352]  # published as '>صندوق سرمایه‌گذاری بازنشستگی تکمیلی ...'

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

MEDIUM

Python subprocess execution detectedscripts/render_promo.py:76 · Python subprocess execution detected

subprocess.run([ffmpeg, "-y", "-loglevel", "error", "-framerate", str(args.fps), "-i", str(frames_dir / "f%04d.png"), "-i", str(palette),

Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscripts/gen_site_data.py:137 · Python subprocess execution detected

collected = subprocess.run([sys.executable, "-m", "pytest", "--collect-only", "-q"], cwd=ROOT, capture_output=True, text=True).stdout

Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscripts/gen_bench_charts.py:49 · Python subprocess execution detectedreturn subprocess.run(cmd, capture_output=True, check=True).stdout.decode("utf-8", "replace")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Hidden zero-width characters detectedtests/test_status.py:148 · Hidden zero-width characters detected — may conceal content

assert (first["symbol"], first["name"], first["date"], first["jdate"], first["time"]) == ("ثنوسا", "نوسازی‌وساختمان‌تهران‌", "2026-11-04", "1405/08/13", "18:45:44")

Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

MEDIUM

Python subprocess execution detectedscripts/render_promo.py:59 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscripts/render_promo.py:70 · Python subprocess execution detectedsubprocess.run([ffmpeg, "-y", "-loglevel", "error", "-framerate", str(args.fps), "-i", str(frames_dir / "f%04d.png"),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

Cost to the agent

Instructions loaded

≈517 tok

2 files · 81 in bundle

Tool list per prompt

≈0 tok

0 tools · 0 per tool

Handshake

no reply

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.