riskofficer

Calculates value at risk, runs simulation and stress tests, and supports allocation approaches such as risk parity and Black-Litterman, plus pre-trade checks, sector concentration and cross-portfolio correlation. Only one environment variable is required, the access token, and no external binaries are needed, which keeps setup small. The security note is candid: tokens are issued at account level with no scoping, so anything holding one reaches the whole account, and the recommendation is to keep it in the session environment rather than a world-readable config file. Portfolio data leaves the machine for the provider's endpoint, which matters for confidential holdings.

Use case: Sizing up concentration risk before a trade

RiskOfficer is a hosted analytics service for portfolio risk, covering value at risk, simulation, stress testing, optimisation methods and concentration checks. This skill is the client for it, and the whole connection is one environment variable. ## What it does - Calculates value at risk and runs monte carlo simulation. - Runs stress tests and pre trade checks. - Optimises with risk parity, calmar and black litterman approaches. - Checks sector concentration and cross portfolio correlation. - Supports ticker search, broker sync, batch portfolio creation and portfolio comparison. ## When it is the wrong choice It is a hosted api, so every calculation depends on a reachable service and a valid token rather than on anything local; there is no offline mode at all. The tokens are account level with no scoping, which means a leaked token exposes everything the account can do rather than one capability. Where the token is stored is entirely your responsibility, and putting it in a shared configuration file widens who can read it. And because the analytics live behind the service, the models cannot be inspected or reproduced locally, so the results have to be taken on trust. ```bash export risk_officer_token=replace-with-your-token ``` ## Working notes - The token is issued by the service's own application and can be revoked there. - The token is only ever sent in the request header. - Preferring a session environment variable over a shared config file is the documented advice.