mcp-metatrader5-server

The server primarily acts as a bridge to a local MetaTrader 5 terminal. It uses environment variables (loaded via python-dotenv) for its own transport configuration, which is a good practice. Input to trading tools (like order_send) is validated using Pydantic models. There are no obvious signs of 'eval', obfuscation, or malicious network patterns. The server can run in stdio mode (default, generally safer for local client interaction) or HTTP mode (configurable to localhost for development). The primary security risk lies in improper usage by the end-user (e.g., connecting to live trading accounts without robust risk management, exposing the HTTP endpoint publicly) rather than inherent code vulnerabilities. The test_client.py has hardcoded fallback credentials, but this is for a test script and not the main server runtime logic.