diff --git a/server.py b/server.py
index 0b46cbbe..3656155c 100644
--- a/server.py
+++ b/server.py
@@ -9,6 +9,9 @@ import uuid
 import urllib.request
 from datetime import datetime
 from pathlib import Path
+import sys
+sys.path.insert(0, "/home/hmo/MoFin/scripts")
+sys.path.insert(0, "/home/hmo/MoFin")
 
 from flask import Flask, jsonify, send_from_directory, request
 
@@ -704,6 +707,25 @@ def trigger_evaluation():
 
 
 # ── 策略反馈API ──
+@app.route("/api/candidates")
+def get_candidates():
+    """候选股管道数据"""
+    import sqlite3
+    conn = sqlite3.connect("/home/hmo/MoFin/data/mofin.db")
+    conn.row_factory = sqlite3.Row
+    rows = conn.execute("""
+        SELECT code, name, reason, entry_range, stop_loss, target,
+               score_2nd, score_3rd, score_4th, score_5th, score_final,
+               pass_s2, pass_s3, pass_s4, pass_s5, pass_final,
+               promoted, promoted_at, log, created_at
+        FROM candidates WHERE dropped IS NULL OR dropped=0
+        ORDER BY COALESCE(score_final,0) DESC, created_at DESC
+        LIMIT 50
+    """).fetchall()
+    conn.close()
+    return jsonify([dict(r) for r in rows])
+
+
 @app.route("/api/feedback")
 def get_feedback():
     data = _load_json(DATA_DIR / "strategy_feedback.json", {})