alpaca-mcp-server

The server demonstrates good security practices by: (1) explicitly warning against hardcoding secrets and command-line key passing, instead favoring .env files and interactive prompts; (2) defaulting HTTP transport to localhost (127.0.0.1) for local connections, requiring explicit configuration for remote exposure; (3) using Kubernetes Secrets for sensitive variables in Helm deployments; (4) implementing an `AuthHeaderMiddleware` for secure OAuth bearer token passthrough in multi-tenant HTTP environments. Specific options trading error handling guides users on required permissions for high-risk strategies like short straddles/strangles, reducing accidental exposure to uncovered positions. No `eval` or obfuscation found.