mt-data-mcp

The system utilizes dynamic module loading for forecasting methods (e.g., `GenericSktimeMethod`, `GenericMLForecastMethod`) where a user-provided string specifies the Python class path. If a publicly exposed server allows arbitrary input to these parameters, it creates a severe remote code execution vulnerability, allowing untrusted users to import and execute arbitrary Python code. Additionally, `huggingface_hub_download` in `pretrained.py` can download external models, posing a supply chain risk if models are malicious or compromised. Trading operations (`trading_place`, `trading_modify`, `trading_close`) are inherently high-risk, managing real funds; while implemented using the official MT5 API, their misuse or exploitation requires robust MT5 account-level security and explicit user consent. No direct use of `eval` or `os.system` was found, and MT5 credentials are loaded from environment variables, which is good practice.