yahoo_fantasy_mcp

The server explicitly states it provides read-only access, significantly reducing risk. Authentication details (consumer keys, secrets, tokens) are handled via environment variables or a local `oauth2.json` file, which are standard and secure practices, avoiding hardcoding. The `stdio_transport` uses `pydantic.BaseModel.model_validate_json` for incoming JSON-RPC messages, which is robust against typical JSON parsing vulnerabilities. No `eval` or other highly dangerous functions are directly used for dynamic code execution. The main risks would be in the underlying `yahoo_fantasy_api` library or the Yahoo API itself.