How to connect Claude or Cursor to the moomoo MCP server (OAuth scopes explained)

✓ Written from official docs · checked 2026-10-30

moomoo hosts its MCP server at https://mcp.moomoo.com/mcp. There's no API key: you sign in through moomoo's OAuth consent page and choose which permission scopes the AI gets. These steps come from moomoo's MCP Quick Start, Authentication page and Q&A.

1. Claude Code

claude mcp add moomoo-mcp \
  --transport http \
  https://mcp.moomoo.com/mcp

2. Claude Desktop

moomoo's documented entry for claude_desktop_config.json:

{
  "mcpServers": {
    "moomoo-mcp": {
      "url": "https://mcp.moomoo.com/mcp"
    }
  }
}

3. Cursor

Add the same entry to .cursor/mcp.json. moomoo says any other client that supports the HTTP transport can use the same URL.

4. Sign in and pick scopes

On your first moomoo question, the client opens moomoo's OAuth consent page in your browser.
Log in and choose the scopes to grant (table below).
The client stores the token and reuses it in later sessions.

moomoo suggests checking the connection with a simple price question, such as the current price of Tencent.

5. The four OAuth scopes

Scope	What it allows (per moomoo)
`quote:read`	Real-time quotes, historical candlesticks and market data
`quote:write`	Adding and removing watchlist symbols
`trade:read`	Account balance, positions and order history
`trade:write`	Submitting and cancelling orders

moomoo says scopes are granted independently. For a research-only agent, grant quote:read (and trade:read if it should see positions) and leave trade:write off. moomoo's tools page says order tools also need a trade password, warns that trading involves real funds, and recommends testing with small amounts first.

6. Tokens and revoking access

Access tokens last about 2 hours; the client refreshes them automatically.
If a token is unused for more than 14 days, or a refresh fails, the client asks you to authorize again.
Revoke a token any time from the app keys tab of your moomoo OpenAPI dashboard. If you think a token leaked, moomoo says to disable it in the console straight away.
The MCP server stores no credentials; your AI client keeps the tokens locally.

Safety checklist

Start without trade:write. Add it later by authorizing again.
Keep your AI client set to ask before each order tool runs, and confirm symbol and quantity before any order, as moomoo recommends.
moomoo's MCP docs don't describe paper trading. See the moomoo MCP listing for what moomoo's OpenAPI team told us about simulated accounts, and Webull MCP vs moomoo MCP for how the two gate orders.
To enforce dollar caps and symbol lists yourself, see TAS Guard.

Source: https://open.moomoo.com/mcp-docs/quick-start. Not financial advice.

FAQ

What is the moomoo MCP server URL?

https://mcp.moomoo.com/mcp, per moomoo's MCP Quick Start.

Does the moomoo MCP need an API key?

No. It uses OAuth: your client opens moomoo's consent page, you log in and choose scopes, and the client stores the token.

Which scope lets the AI place orders?

trade:write (submit and cancel orders). Leave it off at consent and the AI can only read quotes, manage watchlists or read account data, depending on the other scopes you grant.

How do I revoke the AI's access to moomoo?

Invalidate the token from the app keys tab of your moomoo OpenAPI dashboard. Tokens unused for more than 14 days also expire.