What does read-only MCP access to trading history actually permit?
By Chart Reporter Reviewed 2 min read
The short answer
Chart Reporter's current MCP tools read the authenticated user's journal data and do not place or modify broker trades. Read-only describes the tool operations, not the sensitivity of the information. Trade history can still reveal accounts, strategies, timing and results.
Verify the connection before the analysis
Complete the client authorisation flow for the intended Chart Reporter account, then ask it to run whoami. Check the account and hub information before requesting detailed trades. A valid connection to the wrong account is still the wrong foundation for a review.
The current connection uses the mcp:full scope rather than separate per-tool consent switches. Do not assume you selected only one analysis capability if the consent model does not offer that granularity. Review the actual displayed consent and the client receiving access.
Keep read access distinct from execution
The journal's current MCP tools investigate and report; they do not submit orders to the broker. That boundary is useful for historical review, but it applies to this connection. Another terminal integration available to the same assistant may expose different capabilities.
For example, an assistant connected to both a journal and a terminal should identify which tool supplied a fact and which tool could perform an action. The presence of a read-only journal does not turn an unrelated execution-capable tool into a read-only one. Inspect permissions at the individual connection level.
Manage disclosure and revocation
Share only the history needed for the review and understand the connected client's handling of that data. Avoid placing credentials in prompts, notes or screenshots. Read access can expose commercially or personally sensitive patterns even if no order can be changed.
If you no longer need access, disable MCP in Chart Reporter's Connections settings and disconnect it in the client. Expiry can require a fresh sign-in and consent flow. Keep a review's useful findings separate from its access tokens, and do not treat an assistant's inability to execute trades as a guarantee about the correctness or confidentiality of everything it says.
Sources and further reading
Related guides
Is the reporter API key the same as an MCP access token?
Distinguish terminal reporting authentication from an assistant's journal-reading authorisation.
Can an AI assistant read my Chart Reporter screenshots and notes?
Understand the difference between stored journal material and what the current MCP tools return.