wealthfolio-mcp

The server uses `pydantic_settings` to load API keys and base URLs from environment variables or a `.env` file, which is a good practice for secret management. No `eval` or `exec` functions were found. The `httpx` client handles HTTP errors appropriately with `raise_for_status`. FastAPI provides a robust framework with input validation (explicitly enhanced in custom OpenAPI schema for UUID formats). Error handling uses `HTTPException` for server-side issues. The `Dockerfile` uses a minimal Python base image. The project actively documents security best practices in `AGENTS.md`. Potential improvements could include explicit server-side UUID validation beyond OpenAPI hints, and implementing authentication/rate limiting as mentioned for future enhancements, but for its current scope, it is well-secured.