Hfdatalibrary MCP Server

The HF Data Library API is a sophisticated financial data server with comprehensive authentication and authorization systems, but contains several security concerns that warrant attention. A hardcoded admin email list, admin notification functionality, and environment variable handling patterns present information disclosure risks. Additionally, the codebase lacks input validation on some user-controlled fields, and there are potential CORS/CSRF bypass concerns despite mitigation attempts. The permissions (network_http, env_vars, database access) are appropriate for the server's purpose, but implementation details create moderate risk. Supply chain analysis found 5 known vulnerabilities in dependencies (1 critical, 0 high severity).

4 files analyzed · 13 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.