alpaca-mcp-server

The project demonstrates strong security practices for credential handling. It actively warns against passing API keys via command-line arguments, uses `getpass` for interactive secret input, and attempts to set restrictive file permissions on the `.env` file. The `AuthHeaderMiddleware` correctly extracts and passes OAuth `Authorization` headers, prioritizing them over environment variables, which is a secure pattern for multi-tenant and remote deployments. While binding to `0.0.0.0` for HTTP transport requires external security measures, the documentation explicitly highlights this need. No `eval` or arbitrary code execution from untrusted input was found in the core server logic.