An MCP server is a small service that lets an AI assistant read data from a system you already use, through a fixed set of named tools rather than through text you paste in. For an investor it removes the copy-and-paste step: instead of describing your holdings to an assistant, you grant it permission to read them. The protocol decides what the assistant may ask for, and you decide what it is allowed to see.
Key takeaways
- MCP stands for Model Context Protocol, an open standard for connecting an AI assistant to a source of data.
- The server exposes named tools with fixed inputs and outputs, so the assistant retrieves structured data instead of guessing from pasted text.
- Access is granted by you, per assistant, and is limited to the permissions you approve.
- A read-only server cannot place an order, change a setting, or hand over a credential, because no such tool exists in it.
- The data an assistant reads still leaves for your AI provider, so what happens to it afterwards is governed by their terms rather than by the platform you read it from.
What does an MCP server actually do?
MCP stands for Model Context Protocol. It is an open standard that describes how an AI assistant asks another system for information. The system that answers is called an MCP server, and what it publishes is a list of tools: each one has a name, a fixed set of inputs it accepts, and a fixed shape of data it returns.
The important word is fixed. An assistant connected to an MCP server cannot ask it for anything it likes. It can only call the tools the server publishes, with the inputs those tools accept. So the server, not the model, decides what is readable. That is the difference between an assistant that reads your data and an assistant that has access to your account.
Why does this matter for an investor?
Today most people who ask an AI assistant about their portfolio do it by pasting. They type out their holdings, or upload a screenshot of a broker app, and the assistant answers from that. Every step of that is fragile. Numbers get transcribed wrong, a screenshot is a moment in time with no date attached, and anything left out of the paste simply does not exist as far as the model is concerned.
An MCP server removes the transcription. The assistant reads the figures from the source, and the source can tell it how old they are. That last part matters more than it sounds: a portfolio value with no date on it is a number an assistant will happily reason about as though it were current, which is one of the failure modes described in Verifying AI financial data.
The full tool reference, the three permission scopes, the rate limits, and the setup steps for Claude, Codex, and Cursor.
What can an MCP server see, and what can it not?
Only what its tools return. A server built to read a portfolio publishes tools for holdings, totals, and allocation, and nothing else. There is no general query, no way for an assistant to browse, and no way for it to reach a table the server did not decide to publish. If a category of data has no tool, it is not reachable, and no amount of clever prompting changes that.
Permissions narrow it further. A well-built server groups its tools into scopes and asks you to approve each one, so an assistant you gave watchlist access to cannot read your holdings. This is the same consent model you already meet when an app asks to read your calendar but not your contacts. It is worth reading the approval screen rather than clicking through it, because that screen is where the whole of the access control happens.
Can a connected assistant trade on your behalf?
Only if the server publishes a tool that places orders, and a read-only server does not. This is a design decision made by whoever built the server rather than a property of the protocol, so it is worth checking. A platform that is not a broker has no order path to expose in the first place, which is the simplest form of the guarantee.
Be careful about the distinction between an assistant that can read and an assistant that can act. Reading is reversible and bounded: the worst case is that a figure is misread and you are told something wrong, which is why every number still deserves the verification described in Verifying AI financial data. Acting is neither. An assistant that can place an order can lose money without a person confirming it, and no current model should be trusted with that.
What are the real risks of connecting one?
The first is that the data leaves. Once your holdings reach your AI provider, they are handled under that provider's terms, not under the terms of the platform you read them from. Nobody in the middle can monitor or undo that, so the decision to connect is a decision about which provider you trust with your positions.
The second is that models are non-deterministic. Accurate input does not produce a guaranteed-correct answer. A model given a correct list of holdings can still misread a weight, miscompute a return, or state a confident figure it invented, which is the failure covered in Why AI models disagree. An MCP server improves what goes in. It does nothing about the reasoning that happens afterwards, and treating a clean input as proof of a clean answer is the mistake most likely to follow from connecting one.
The third is narrower but real. Any text an assistant reads becomes part of what it is working from, so a well-built server returns numbers, symbols, dates, and its own fixed labels rather than free text written by other people. A server that hands an assistant somebody else's prose is handing it instructions it cannot tell apart from yours.
How does the Artha MCP server work?
Artha Terminal publishes a read-only MCP server. It exposes twelve tools covering your own portfolio, your risk metrics, your watchlists and alerts, symbol reference lookup, and your household's combined exposure where every member has agreed to it. Every result states the date of the underlying data, and none of them returns a market price for a symbol you do not hold, which keeps it a view of your own account rather than a market-data feed.
Three things it deliberately cannot do. It cannot place, change, or cancel an order, because SEBI-regulated execution belongs at your broker and Artha is not one. It cannot return a broker credential. And it cannot enumerate what a named family member holds, only what the household holds in aggregate. Access is granted per assistant through a consent screen that lists each permission in a sentence, and it costs nothing. The full tool reference is published rather than kept internal, so you can read exactly what an assistant would be able to see before you approve it, and the setup steps for each client are documented on the same page.
