sleeper-mcp

The server uses axios with a fixed base URL to the public Sleeper API, which significantly mitigates Server-Side Request Forgery (SSRF) risks. Input arguments are directly interpolated into the URL path for Sleeper API endpoints; while the Sleeper API itself is expected to handle path sanitization, a highly malformed input could potentially access unexpected public Sleeper API endpoints within the same domain. There is no usage of 'eval', 'child_process', or direct file system access, and no hardcoded secrets were found. Data returned from the Sleeper API is stringified and relayed, so its content depends on what the public Sleeper API exposes.