global-stock-data: an architecture diagram titled 13 layers that draws six, and three tiers that forbid half of it

The diagram is headed thirteen layers and draws six branches

The page opens its Architecture section with a labelled header and a tree that does not match the label:

US Full-Stack Data · 13-layer architecture · V2.0
│
├── Market Data      Sina + Tencent + Eastmoney push2        Real-time quotes, 25-78 fields
├── K-line           Sina(back to 1984) + Yahoo chart        Daily / weekly / monthly / minute
├── Technical Ind.   MA/EMA + MACD + RSI + KDJ + Bollinger   Pure Python, zero extra deps
├── Fundamentals     Eastmoney + Yahoo + SEC XBRL            Statements + key metrics + holdings
├── Fund Flow        Eastmoney push2his                      Daily main/large/medium/small flow
├── Options          Yahoo crumb                             Options chain

Six branches, under a header that says thirteen, under a description that repeats thirteen layers alongside 30 or more endpoints and 11 sources. The endpoint sections further down cover Treasury yield curves, CFTC commitment of traders, a Nasdaq earnings calendar, EDGAR frames and FINRA short volume, none of which appears in the tree.

The branch labelled V2.0 is the version whose release is titled Official-source-first architecture, and the six visible branches name Sina, Tencent, Eastmoney and Yahoo. All four are graded tier C in the compliance table a few sections down. The official tier S sources, SEC EDGAR, Treasury and CFTC, appear exactly once in the drawing, folded into Fundamentals as SEC XBRL, and the other two are absent. So the tree that documents the official source architecture is made almost entirely of the sources that are not official.

v2.0.2 is absent from the release list, and one release title is in Chinese

Three releases are published: v2.0.0 on 2026-07-24 at 11:30:41 UTC, v2.0.1 on the same day at 11:49:06, and v2.0.3 on 2026-07-26. There is no v2.0.2 in the record, so the sequence skips a step between two releases that are nineteen minutes apart.

The first two are what produced the current architecture. v2.0.0 is titled Official-source-first architecture and v2.0.1 is titled Error handling and timezone correctness. v2.0.3, two days later, is titled in Chinese: 腾讯行情 / EDGAR Frames / CBOE 三项数据正确性修复, which names the Tencent quote path, EDGAR frames and CBOE as three data correctness fixes. The repository carries both an English and a Chinese README, and the release titles are not consistently in either language, so a changelog reader has to read two languages to follow the same project.

Those three fixes are exactly the three places where a quiet wrong answer is worst. A market data tool that returns a plausible number for Tencent quotes, for the EDGAR frames screener, or for a CBOE chain has no error to report, and the corrections shipped two days after the architecture that introduced them.

The last recorded push is 2026-09-25, which is well after the newest release, so there is work in the tree that no tag covers.

Both options paths sit in the tier that needs a licence

The options layer offers two sources and both are graded tier C.

CBOE is listed as the primary: the full chain, implied volatility, delta, gamma, vega, theta and rho, 0DTE filtering, and unusual flow detection on a volume to open interest ratio above one. Yahoo is the fallback: all expiries, and no Greeks.

The compliance table puts CBOE in tier C, whose commercial column reads needs permission, and quotes its terms as requiring approval in advance and the execution of a licence agreement. The same row names Yahoo and states personal use only. So the endpoint with full Greeks cannot be used commercially without signing something, and the one you may reach for instead returns no Greeks at all.

Neither option is available under the terms the project itself grades as safe. The tier S sources, SEC EDGAR, Treasury and CFTC, have none of the market microstructure you would want from an options chain, and tier B is a single source, FINRA, whose files are for short volume.

This is also why the star marks in the endpoint summary sit where they do. Flow and positioning, filings and events, and screener and macro all carry one, and those three groups are the ones containing CBOE, FINRA, Nasdaq and the EDGAR frames work. The marked groups are the ones to read the tier table against before trusting in a script.

FINRA is graded non commercial and still exposed as a plain endpoint

The short volume layer is a single row: FINRA Reg SHO, market wide daily short volume across 12,112 symbols, with per symbol series and ratio ranking.

The tier table grades FINRA as tier B, which is the only tier that is neither permissive nor closed. Its commercial column reads verify first and its redistribute column is refused. The basis quoted is that the files are published for download while the terms prohibit data mining, scraping or harvesting tools including robots, and state non-commercial use.

So a source whose terms prohibit the exact activity an agent performs is still wired up as a working endpoint, distinguished only by a table note from the tier S calls beside it. The difference is invisible at the call site. Nothing in the layer name, the endpoint description or the per symbol series signals that this one needs a legal read before a commercial deployment touches it, and unlike the CBOE row there is no fallback to choose instead.

The stated guidance is to rely only on tier S for commercial use. The endpoint list does not sort itself by tier, so that guidance has to be applied by hand, one source at a time, before the tool is used in anger.

A working HKEX layer was built and then taken out

The excluded row of the tier table is not a gap. It names HKEX CCASS and quotes its terms as prohibiting any robot, bot, spider or scraper, and as applying whether or not for gain. The conclusion drawn in the same row is that the tool ships no scraper for it.

The text underneath says more: a working Hong Kong shareholding layer was built, and then removed, because shipping code that violates a source's terms would defeat the point of grading sources in the first place. That is an unusual thing for a data project to state, since the layer was already working and the alternative was to keep it and label it.

The HK coverage that survives comes from elsewhere. The full market list advertises 18000 or more Hong Kong stocks and the fundamentals layer advertises 75 Hong Kong fields on Eastmoney's GMAININDICATOR, both of which reach the market through a tier C source rather than through the exchange.

One caveat sits against the whole table. The tiers come from reading each source's terms on 2026-07-24, a single date, and the page still names that date. Terms change without the version number moving, so a grading that is accurate on one afternoon is a snapshot rather than a standing property.

Zero auth in the header, a crumb flow in the architecture

The summary line advertises zero auth and only requests as the dependency. The architecture tree names Yahoo crumb as the source of the options layer.

Both are true and they describe different boundaries. The crumb is the authentication dance Yahoo requires before it will return an options chain, and the project performs it so the caller does not have to. The value proposition states the same thing from the other direction: you no longer memorise Eastmoney secid prefixes, Yahoo crumb auth flows, or SEC EDGAR CIK mappings.

What zero auth describes is the caller's position, not the project's. Every request still carries whatever identity and cookie flow the source demands, obtained on the user's behalf and under the user's terms. That matters for the tier table directly, because the project says it distributes code and not market data, and that data is fetched by the user under each source's own terms. The fetching is exactly where the terms bite, and no login screen appears to mark where it happens.

The one dependency claim is easy to check and easy to under read. The quick start installs requests and nothing else, and the technical indicators branch is described as pure Python with zero extra dependencies, so the moving averages, MACD, RSI, KDJ and Bollinger are computed in the file itself.

SEC_CONTACT is set by editing the downloaded file, and EDGAR rejects the alternative

SEC is the only tier S source with a hard operational limit, and the setup for it happens in the file you downloaded.

The instruction is to set `SEC_CONTACT` in SKILL.md to a real name and email before using the SEC layers. SEC requires a declared User-Agent, requests without one are rejected as an Undeclared Automated Tool, and the project states that the code raises a clear error if you forget.

That is a good failure, and it is still a manual step in a three step install. The value lives inside a downloaded file rather than in an environment variable, so it cannot be set from a CI secret store, it does not survive a re-download, and it is one more reason a re-run of the curl overwrites whatever a previous pass put there. The stated rate ceiling is 10 requests per second, which the tool has to respect on its own since nothing in a skill file throttles a caller for it.

The quick start itself is three steps: create ~/.claude/skills/global-stock-data, curl the SKILL.md into it from the main branch, and pip install requests. Launching Claude Code afterwards is enough for the skill to activate. For Codex and OpenClaw the instruction is to paste the same file into a system prompt or project context file, where the embedded Python runs as is.

The whole product is one Markdown file, fetched from a moving branch

The repository has seven top level entries. One of them is the product:

# 1. Create the skill directory
mkdir -p ~/.claude/skills/global-stock-data

# 2. Download SKILL.md
curl -o ~/.claude/skills/global-stock-data/SKILL.md \
  https://raw.githubusercontent.com/simonlin1212/global-stock-data/main/SKILL.md

# 3. Install the dependency
pip install requests

Everything else is `.github/`, `CHANGELOG.md`, `LICENSE`, `README.md`, `README_zh.md` and `assets/`. There is no source tree, no package manifest and no detected primary language, which is consistent with the deliverable being a structured Markdown file with Python embedded in it rather than a program you install.

The URL names the main branch and no tag, so a curl run today and a curl run next month deliver different files, and there is no version recorded in the installed skill that would let you tell which one you have. For a tool whose stated purpose is to be dropped into an assistant's context, that is the sharpest operational edge on the page: the tier table is graded, the rate limits are stated, and the version of the graded thing itself is not pinned anywhere in the install.

Two smaller things sit alongside it. The endpoint tables run into a market screener section whose header row and separator are followed by no rows, so the screener's own endpoints are not on the page even though the summary above it already quotes EDGAR frames numbers, net income for CY2025Q1 across 5,309 companies. And the page opens with an Open to Work notice from the author, with a contact address, above the documentation.

Editorial conclusion

Treat this as a well labelled map of the US market data sources rather than as a service you switch on. The grading is the strongest thing here and the parts to lean on are the SEC EDGAR filing stream, the XBRL frames screener, the Treasury curve and CFTC positioning, which are tier S and permit commercial use with a declared User-Agent and a 10 request per second ceiling. Keep CBOE, Nasdaq, Yahoo, Eastmoney, Sina and Tencent on the far side of a commercial decision, since both options routes sit in tier C and the Yahoo fallback returns no Greeks anyway. Read the FINRA terms yourself before any commercial use, since a non commercial source and a scraping prohibition are attached to an endpoint that looks identical to its neighbours. Verify the compliance grades yourself rather than trusting them, because they were read on a single afternoon in July 2026 and terms move without the version moving. Pin the skill file to a commit or copy it somewhere under your own control, because the install fetches a branch and records no version. Set the SEC contact in the file deliberately and remember a re-download clears it.

Frequently asked questions

Official sources

1. Issues
2. License: Apache-2.0
3. README
4. Releases
5. simonlin1212/global-stock-data on GitHub