moomoo-api-mcp

The server uses environment variables for sensitive trading passwords (MOOMOO_TRADE_PASSWORD, MOOMOO_TRADE_PASSWORD_MD5), which is a good practice. It connects to the local Moomoo OpenD gateway (127.0.0.1:11111) by default, limiting direct external network exposure. Critical trading tools (place_order, modify_order, cancel_order) include explicit warnings in their docstrings, instructing AI agents to ask for user confirmation before executing actions, especially in 'REAL' trading environments. No 'eval' or direct execution of arbitrary code from user input was found. The main security risk comes from the AI agent's interpretation of instructions and the default 'REAL' environment for account tools, which is mitigated by strong AI agent guidance in the README and tool docstrings.