mcp-metatrader5-server

The server's `initialize` tool takes a `path` argument to the MT5 executable. While necessary for its function, an unconstrained AI or user could potentially provide a malicious path. If the server is configured for HTTP transport (`MT5_MCP_TRANSPORT=http`) and exposed publicly (not limited to `127.0.0.1`), it could be vulnerable. Sensitive MT5 account credentials (login, password, server) are passed as direct arguments to the `login` tool, requiring secure management by the client application and not exposing them in client-side hardcoding or insecure environment files. No obvious 'eval' or direct arbitrary code execution patterns were found within the core server logic.