alpaca-mcp-server

Credentials (`ALPACA_API_KEY`, `ALPACA_SECRET_KEY`) are designed to be injected at build time via arguments and baked into the Docker image as environment variables. The entrypoint script includes strong validation to prevent the server from starting with default 'changeme' values or empty credentials. However, this approach means any built image containing real credentials must be treated as highly sensitive and should never be pushed to public registries, as anyone with the image can extract the keys. While this risk is explicitly documented and mitigated with runtime validation, baking secrets into images is generally less secure than runtime injection (e.g., via Docker secrets or a secrets manager) as it increases the risk of credential compromise if the image itself is compromised.