alfa-pro-terminal-mcp

The server connects to a local WebSocket endpoint (ws://127.0.0.1:3366/router/) of the Alfa Investments PRO Terminal desktop app, minimizing external network attack surface. Configuration can be overridden by environment variables (TERMINAL__ENDPOINT, TERMINAL__TIMEOUT). No obvious hardcoded secrets, obfuscation, or 'eval' usage in the provided snippets. The project includes a SECURITY.md file detailing vulnerability reporting. While appsettings.json has 'AllowedHosts: "*"', this is less critical for a local stdio-based MCP server whose primary interaction is not through HTTP. The AGENTS.md document also describes good security-conscious coding practices (e.g., 'fail fast', no reflection for business logic).