Golf Coach MCP Server

Golf Coach is a well-structured MCP server for fetching Trackman Golf data with proper authentication and reasonable permissions for its purpose. The codebase demonstrates good security practices in auth handling, token management, and input validation. However, there are several moderate-severity concerns: reliance on browser automation (Playwright) for token capture with incomplete error handling, unsafe GraphQL query construction patterns, potential path traversal risks in local file operations, and overly broad exception handling that could mask security issues. These findings do not indicate malicious intent but represent areas where security could be hardened, particularly around token refresh logic and file I/O validation. Supply chain analysis found 5 known vulnerabilities in dependencies (1 critical, 3 high severity). Package verification found 1 issue.

5 files analyzed · 17 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.