Casablanca-Bourse Lens

What it is

The Casablanca exchange publishes no developer API worth the name. Its data is spread across a broker's internal endpoints, the central bank, the market regulator's filings, and commodity and FX feeds — each with its own shape, none built to be queried in a sentence.

Lens collapses that into one tool surface an assistant can use directly. You connect it once, then ask in plain language: what the market did today, how a stock's momentum looks, which companies report next, what the policy rate is doing to the banks.

The design decision that matters

Every tool talks to a provider interface, never to a source. The server is the only component that knows which concrete provider is wired in, so a data source can be replaced without touching a single tool definition — and the assistant never notices.

Caching sits beside that as its own layer rather than inside the providers. Each kind of data carries its own freshness: seconds for quotes, ten seconds for the order book, hours for macro series, a day for company profiles. A cold upstream degrades to slightly stale data instead of failing the question.

• The exchange's API serves only a leaf certificate, so the intermediate is bundled and loaded alongside certifi rather than disabling verification.
• Retries use exponential backoff on 5xx and transport errors only — a 404 raises immediately, because it isn't transient.
• Corporate actions are stored separately so price history can be back-adjusted for splits and dividends.

Running it in public

The same server runs two ways: over stdio on a laptop, and as a public HTTP endpoint. Public changes the threat model, so the public build serves only market-data tools — filtered by where each tool is defined, not by its name, so a stray registration can never publish the local-file or account-trading tools.

On top of that: per-client rate limiting that reads forwarded headers only from a proxy it trusts, argument size limits so cache keys can't be flooded, request body caps, and refusal of unexpected Host headers. A security review of this code produced fixes for all four before it shipped.