MCP Overview

Model Context Protocol - a local server that exposes Quant Charts to external AI clients (Claude Desktop, Cursor, ChatGPT MCP-aware clients, etc.) so they can read your workspace, edit strategies, run backtests, and capture chart screenshots.

Quant Charts ships an MCP server that runs alongside the app. When you connect a client to it, the model can:

• list and read your strategies / indicators / notebooks
• create / edit / delete / rename workspace files
• validate Python (decorator + AST) and Rust (cargo check) before saving
• query parquet data files via DuckDB
• run a single backtest or a parameter sweep and read the resulting metrics
• read the QC terminal buffer (tool calls, script output, errors)
• take a screenshot of the active chart
• add or remove strategies / indicators on a chart instance

The server includes a knowledge pack so the model already understands the QC API surface (Python OHLC, Rust TBBO), data-mode rules, the analyzer workflow, and microstructure conventions.

Notes

• Auth: every tool that touches your workspace runs through the same auth + subscription guard the in-app AI uses. Sign in to QC before connecting.
• Sandboxing: file paths are resolved through resolveWorkspaceArg. Anything that escapes the workspace (.. segments, drive cross-overs, sibling-folder injection) is rejected with PathEscape.
• Rate-limited: per-tool token bucket (see Limits below) so a runaway agent cannot spam-loop the file system.
• Logging: every tool call (except ping / describe_capabilities / read_terminal / __internal:list_tools) prints a single line to your QC terminal: [MCP] tool_name(args) -> ok in N ms. Toggle in MCP Settings.

Auth model

Three guard tiers: unguarded, auth, subscription. Same surface as in-app IPC.

Tools declare a guard tier when they register:

• unguarded - ping, describe_capabilities, list_tools. No auth needed.
• auth - requires a signed-in QC session. Most read-only tools (read_file, list_files, search_files, get_app_info) and all file-mutation tools (edit_file, create_file, delete_file, rename_file).
• subscription - requires an active or trial subscription. Backtest execution (run_backtest, run_sweep) and sweep-grade tools.

The MCP server caches auth checks for 5 minutes per session so most calls are sub-millisecond. Sign out of QC and the cache invalidates immediately.