MCP, MCP server
Kis Agent
한국투자증권 OpenAPI Python 래퍼 - Korea Investment & Securities Trading API Client
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV SECRETS_ENV_READ OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
examples/portfolio_realtime_monitor.py, line 422
os.system("cls" if os.name == "nt" else "clear") - INSTALL_UNPINNED Low
Dependencies use a range or git URL with no lockfile.
requirements.txt, line 2
requests>=2.31.0,<3.0.0 - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
kis_agent/core/auth.py, line 483
res = requests.post( - SECRETS_PATH_DOTENV Low
Mentions a .env file.
examples/calculate_basis.py, line 13
`.env`에 `KIS_APP_KEY` / `KIS_APP_SECRET` / `KIS_ACCOUNT_NO`가 필요하다. - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
examples/async_auth_example.py, line 31
app_key=os.getenv("KIS_APP_KEY"), - OBFUSCATION_FILE_OVER_READ_CAP Note
A file was over the read cap and was not fully read.
docs/api_reference/response_mappings.json, line 1
{ - OBFUSCATION_FILE_CAP_REACHED Note
The 400 file cap was reached before every file was read.
docs/api_reference/response_mappings.json, line 1
{
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
examples/portfolio_realtime_monitor.py, line 422
os.system("cls" if os.name == "nt" else "clear")
examples/run.py, line 548
subprocess.Popen(
examples/websocket_multi_subscribe.py, line 76
os.system("cls" if os.name == "nt" else "clear")
Show more
kis_agent/cli_bridge.py, line 67
result = subprocess.run(
kis_agent/core/auth.py, line 51
return os.system("cls" if os.name in ("nt", "dos") else "clear") # nosec B605
kis_agent/core/technical_analysis.py, line 89
os.remove(csv_file_path)
kis_agent/utils/sector_code.py, line 79
os.remove(zip_path)
kis_agent/utils/sector_code.py, line 150
os.remove(mst_path)
kis_agent/websocket/client.py, line 122
os.system("cls" if os.name in ("nt", "dos") else "clear") # nosec B605
kis_agent/websocket/client.py, line 1181
os.system("cls" if os.name in ("nt", "dos") else "clear") # nosec B605
scripts/spec_conformance/official.py, line 308
log = subprocess.run( # nosec B603 B607
Install and update
Concern
dependencies are not pinned.
INSTALL_UNPINNED
requirements.txt, line 2
requests>=2.31.0,<3.0.0
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
kis_agent/core/auth.py, line 483
res = requests.post(
kis_agent/core/auth.py, line 580
res = requests.post(url, data=json.dumps(p), headers=h)
kis_agent/core/auth.py, line 680
res = requests.post(url, headers=headers, data=json.dumps(params))
Show more
kis_agent/core/auth.py, line 682
res = requests.get(url, headers=headers, params=params)
kis_agent/core/client.py, line 446
response = httpx.request(
kis_agent/core/client.py, line 627
response = requests.post(
kis_agent/core/client.py, line 672
response = requests.post(
kis_agent/core/client.py, line 741
response = requests.post(url, headers=headers, json=payload)
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
examples/async_auth_example.py, line 31
app_key=os.getenv("KIS_APP_KEY"),
examples/async_auth_example.py, line 32
app_secret=os.getenv("KIS_APP_SECRET"),
examples/calculate_basis.py, line 13
`.env`에 `KIS_APP_KEY` / `KIS_APP_SECRET` / `KIS_ACCOUNT_NO`가 필요하다.
Show more
examples/basic_usage.py, line 26
app_key = os.environ.get("KIS_APP_KEY")
examples/basic_usage.py, line 27
app_secret = os.environ.get("KIS_APP_SECRET")
examples/daily_price_pagination_example.py, line 25
app_key=os.getenv("KIS_APP_KEY"),
examples/daily_price_pagination_example.py, line 26
app_secret=os.getenv("KIS_APP_SECRET"),
examples/daily_price_pagination_example.py, line 65
app_key=os.getenv("KIS_APP_KEY"),
examples/daily_price_pagination_example.py, line 66
app_secret=os.getenv("KIS_APP_SECRET"),
examples/daily_price_pagination_example.py, line 245
print(" .env 파일을 확인하세요.")
examples/export_trading_history.py, line 20
필수 환경변수 (.env):
examples/paper_trading.py, line 5
# Test Status: Requires live paper-trading credentials (KIS_PAPER=1 in .env)
examples/paper_trading.py, line 10
한국투자증권 API 포털에서 모의투자용으로 따로 발급받아 `.env`에 넣어야 한다.
examples/test_rate_limiter_live.py, line 14
agent = Agent(".env")
kis_agent/cli_bridge.py, line 84
(v1.8.0부터 패키지 부모 디렉토리/~/.env 검색은 제거. 의도치 않은 환경 오염 방지.)
kis_agent/cli_bridge.py, line 88
if os.path.exists(".env"):
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read. the file cap was reached before every file was read.
OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED
docs/api_reference/response_mappings.json, line 1
{
tests/unit/test_ws_subscriptions_extra.py, line 1
"""WSSubscriptionMixin의 남은 시장별 편의 구독 경로 테스트."""
Licence
Note
no licence file found.
LICENCE_MISSING
No file path was stored.
no licence file found.
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit b85a304b0f4e. can delete files. dependencies are not pinned. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read. no licence file found.
Date and source
Date checked:
github.com
Commit graded: b85a304b0f4efc307462ea72e9c612a3880add04
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.