kStock-mcp-server

Sensitive information (API keys, account numbers) is loaded from environment variables using `std::getenv`, which is a good practice. Access tokens are obtained via API calls and stored in memory. Request parameters are built from JSON, and `tool::build_query` handles string serialization, reducing direct injection risks. The `mcp::tool_builder` defines parameter schemas, implying input validation by the MCP framework, which is crucial. No direct use of 'eval' or shell command execution from user input is observed. The singleton pattern for `KInvestmentAPI` is noted; while simplifying access, it means credentials are globally shared within the server process, which requires careful management in highly concurrent or multi-tenant scenarios (though not explicitly problematic for the apparent use case).