kis_mcp_server_adk

The README states the server is 'Read-Only' and '매수/매도와 같은 주문 기능은 포함되어 있지 않아 실수로 인한 거래를 방지합니다.' (trading functions are not included to prevent accidental transactions). However, the `src/kis_mcp_server_adk/server.py` file explicitly defines and exposes an `order-stock` tool via `@mcp.tool` decorator, which allows for buy/sell operations. This discrepancy between documentation and actual functionality is a critical security concern as it implies the server can perform sensitive trading actions. While secrets are managed through `.env` files (good practice), the access token is cached in a local `token.json` file, which poses a minor risk if the server's filesystem is compromised. The server also binds to `0.0.0.0` by default, making it accessible from any network interface, necessitating proper network security configurations.