efinance ships an MIT licence, a README that forbids commercial use, and eight unpinned dependencies

An MIT package with a readme that says not for commercial use

The licence section of the packaging manifest declares MIT, and the repository's licence field agrees. The readme, in a line set aside in bold, declares that the project is for learning and exchange only and must not be used for commercial purposes. Those two statements are in direct tension: the licence it ships under grants use for any purpose, including commercial, and the readme asserts a restriction the licence text does not impose. Nobody has reconciled them, and nothing in the repository tries. For a library whose job is to make someone's personal trading system easier, that may well be the author's intent rather than a licence oversight, and intent is not something a licence conveys. If you are thinking of putting this inside a product, the question is one for the author rather than one the files answer.

One data source, and the readme points you elsewhere when it throttles

The packaging manifest names the source in its own one-line description: the data comes from one Chinese market data provider's endpoints. That single fact explains most of what else is in the repository. It explains the Chinese column headings that come back on every request, including for a ticker from a US exchange. It explains the absence of any caching layer, retry configuration or rate-limit handling in the documented interface. And it explains the callout near the top of the readme, which tells users who hit rate limiting or connection timeouts to try a commercial alternative data source instead, with a link that carries marketing tracking parameters. So the honest reading is that this is a thin client over somebody's endpoints, and when those endpoints push back, the documented answer is a paid product rather than a back-off.

Eight dependencies, none of them pinned

The dependency list is not in the manifest. It is a separate file, read at build time, and every entry in it carries no version constraint at all: an HTTP client, a progress bar library, a dataframe library, a retry helper, a concurrency helper, a JSON path library, a terminal formatting library, and an HTML parsing library. Eight packages, zero bounds. Two of those names are generic enough to be the sort of thing a typosquatter registers, and one of them is a single module with a one-word name, so a fresh install of this library is eight unpinned resolutions of which one is yours to reason about. The manifest does declare support for seven Python versions in its classifier list and then does not declare a minimum version at all, so a package installer will happily install it on an interpreter older than anything the author claims to support.

The Dockerfile installs the released package, not your checkout

There is a documented route for installing through Docker, and it is four lines: a base image, a home directory argument, a working directory, and one pip install of the package by name. Note what that last line means. The image installs the published release from the package index, not the source sitting next to the Dockerfile, so the documented Docker path cannot be used to test a change to the repository. The whole file is four lines:

FROM continuumio/miniconda3
ARG HOME=/root
WORKDIR $HOME
RUN pip install efinance

It is the classic difference between an image that ships a product and one that builds a checkout, and this is the first kind. The companion compose file is thinner still: it declares a service, builds from the current directory, reads an environment file from the root, and sets a working directory from a variable. It declares no command, no ports and no image, so bringing it up builds something and then exits.

An environment file is committed and the compose file reads it

The repository root contains a dot-env file with its real extension, not a template, and the compose file is written to read exactly that file for the service's environment and to take its working directory from a variable defined inside it. So a file of actual environment values is tracked in version control and is a required input to the documented container workflow. It is also why the working directory in that file exists at all: the compose file would have nothing to interpolate on a fresh clone, and a reader following the Docker instructions will hit an error or an empty value long before they hit a line about configuration. Two smaller root entries tell you the project is developed on a Mac: a Finder metadata file is committed, which is the sort of artefact that belongs in an ignore list rather than a repository.

The sample transcripts contain values that cannot be right

The examples are interactive transcripts with real output, and they are worth reading as shape rather than as data. The one for a US ticker shows Chinese column headings, a Chinese name for the company, a turnover amount of zero on every row, and prices that are negative. The one for a domestic stock shows negative prices in its earliest rows and a percentage column whose sign disagrees with the amount column beside it. Those two facts together say the transcripts were captured at different times and against different upstream field definitions, and nobody re-checked them. The practical consequence is small but real: if you write an assertion against the shape of a returned frame from these examples, you are asserting against a frame that includes a zero-filled column and a sign convention that was true in 2021.

The version in the manifest is ahead of the newest release

The packaging manifest declares version zero point five point nine. The three newest releases are zero point five point five, zero point five point four and zero point five point one, with a twelve month gap between the oldest two and nothing in 2026. So the number in the manifest has been moved four patch releases past the newest tag, which means either that the release process has fallen behind the source or that the maintainer bumps the manifest and tags lazily. Either way a reader who installs from a package index gets five point five while the repository says five point nine, and the changelog at the root, in lowercase, is the only place the difference could be explained. It is a small thing in a project with one maintainer and a monthly cadence, and it is the kind of gap worth checking before you pin a version.

Editorial conclusion

Efinance is a reasonable way to prototype against Chinese market data if you are experimenting and do not need a guarantee, and the breadth is real: four asset classes, one example notebook each, and a documented path for each of the common requests. Four things to weigh first. The licence question is not settled by the repository: the package is MIT, which permits commercial use, and the readme separately says the project is for learning and exchange only and must not be used commercially. Nobody has reconciled those two, so treat the question as open. Second, the data comes from one provider's endpoints, which is why the readme tells you to switch to a commercial alternative if you hit rate limiting, so expect breakage when that provider changes. Third, there are eight dependencies with no version constraints at all, two of which have very generic names. And fourth, if you want to test a change, the documented Docker path will not do it, because the image installs the released package rather than your source. Licence terms as recorded are MIT.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. Micro-sheep/efinance on GitHub
4. README
5. Releases