Signing in#
- Apps connect with OAuth 2.1: authorization code with PKCE (S256) and dynamic client registration. There are no API keys to paste or leak.
- The sign-in page names the app asking and where it will return you. Nothing happens until you choose Allow.
- Each app gets its own credential, bound to the Mr. Market server and to read-only research. It never sees your password, and it can't be used on any other site.
- Credentials last 90 days. Stored credentials are hashed.
What an assistant can reach#
- The same shared research you see on https://mrmarket.fyi: statements, filings, calls, ownership, screens, markets and macro.
- Nothing personal: no account settings, saved lists or notes, and no other member's activity.
- Every tool is read-only. None of them write, refresh or delete anything.
Cutting one off#
Disconnect an app in Account. The next call it makes is refused, immediately. Other apps keep working. If you think a device was lost, disconnect everything there and sign in again where you need it.
What is logged#
For each tool call: which tool, whether it succeeded, and how long it took, kept for 30 days. Not the arguments you passed or the data returned. Sign-in events are counted for product analytics. Conversations with your assistant stay with your assistant; Mr. Market never sees them.
Text from documents is data#
Filings, earnings call transcripts and news are third-party text. Mr. Market marks every result that contains such text as untrusted, and its instructions tell assistants to treat it as data to quote, never as instructions. Even so, read what an assistant proposes to do with care, as you would with any web content.
Reporting a problem#
If something looks wrong (a sign-in page you didn't start, data that seems tampered with), disconnect the app in Account and tell the person who invited you.