finance_mcp

The server primarily uses the `yfinance` library to scrape data from Yahoo Finance, which carries a note in the README about respecting Yahoo Finance's terms of service. There are no explicit `eval` or direct code injection vulnerabilities observed. The logging configuration includes async handlers which is good. Firestore integration is present but not actively used for core data retrieval by the MCP tools. While `GEMINI_API_KEY` is referenced in documentation, the current implementation bypasses LLM for data fetching, thus reducing direct exposure to potential LLM-related prompt injection risks from this component. The server runs as a local process and communicates via standard I/O for MCP, which generally limits direct network exposure.