stocks-mcp

The server primarily communicates over standard I/O (stdio), significantly limiting its external network attack surface. It relies on the 'yahoo-finance2' library for data fetching, which is a common and generally reliable package. Input parameters are validated and formatted (e.g., getTicker), and there are no apparent uses of 'eval', obfuscation, hardcoded secrets, or direct system calls from user input. The main potential risk is any undiscovered vulnerability within the 'yahoo-finance2' dependency itself, which is a common supply-chain risk for any project using external libraries.