mcp-talib

The server uses Pydantic for input validation, mitigating common injection risks for its numerical inputs. No hardcoded secrets or arbitrary code execution (`eval`, `exec`) were found in the provided code. However, the HTTP transports (MCP HTTP and pure HTTP API) default to `allow_origins=["*"]` for CORS, which is a significant security risk in production environments if not tightened. The server also binds to `0.0.0.0` by default, making it publicly accessible if not firewalled. Without any authentication mechanism, any client capable of reaching the server can execute any indicator. The reliance on the external `ta-lib` C library means its security vulnerabilities would impact this server.