Close Open Privacy Scan

link https://github.com/atilaahmettaner/tradingview-mcp
bolt Snapshot: commit 6755ba0
science engine v1.22
schedule 2026-07-21T20:05:52.697543+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

smart_toy MCP server detected: mcp — detected in dependencies, not a safety judgment.

App Privacy Score

82 /100
Low privacy risk

Low risk · 109 finding(s)

Dependency score: 82 (Low risk)

bar_chart Score Breakdown

egress −15
env_fs −3

list Scan Summary

0 high 0 medium 109 low
First-party packages: 1
Dependency packages: 6
Ecosystem: python

swap_horiz External domains

::ffff:192.168.0.1api.coingecko.comapi.marketaux.combackend.userland.comblogs.law.harvard.edubrotlipy.readthedocs.iocointelegraph.comcreativecommons.orgcyber.law.harvard.edudatatracker.ietf.orgdeveloper.mozilla.orgdocs.python.orgfc.yahoo.comfeeds.content.dowjones.iofinance.yahoo.comfreshmeat.netgithub.comhacks.benhammersley.comhttpbin.orgipinfo.iomadskills.commedia.tangent.orgmodelcontextprotocol.iomy.netscape.commy.theinfo.orgmüller.deother.compastebin.compodlove.orgpostneo.comprismstandard.orgpurl.orgpypi.python.orgpython-tradingview-ta.readthedocs.ioquery1.finance.yahoo.comquery2.finance.yahoo.comreddit.comrequests.readthedocs.iorssnamespace.orgs3-symbol-logo.tradingview.comscanner.tradingview.comschemas.pocketsoap.comschemas.xmlsoap.orgsearch.cnbc.comsearch.yahoo.comstackoverflow.comsymbol-search.tradingview.comtools.ietf.orgtradingview.brianthe.devweb.resource.orgwebns.netwellformedweb.orgwww.coindesk.comwww.georss.orgwww.itunes.comwww.opengis.netwww.python.orgwww.reddit.comwww.rfc-editor.orgwww.tradingview.comwww.w3.orgxmlns.comxn--fiqs8s.icom.museum

</> First-Party Code

first-party (python)

python first-party
expand_more 43 low-confidence finding(s)
low egress production #ac31fb3410ce7f7a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/tradingview_mcp/core/services/backtest_service.py:63 
        with urllib.request.urlopen(req, timeout=15) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #597c50662564d3a5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/tradingview_mcp/core/services/backtest_service.py:72 
            with opener.open(url, timeout=18) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #ae127fadbd8c088a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/tradingview_mcp/core/services/bitcoin_market_service.py:36 
    with urllib.request.urlopen(req, timeout=_TIMEOUT) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #d4b881a5cb3072b7 — Filesystem access.
repo/src/tradingview_mcp/core/services/coinlist.py:23 
                with open(path, 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d22df447932557db — Filesystem access.
repo/src/tradingview_mcp/core/services/coinlist.py:60 
            with open(os.path.join(COINLIST_DIR, name), "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #b6bbbbf6c97ce321 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/tradingview_mcp/core/services/extended_hours_service.py:142 
        with urllib.request.urlopen(req, timeout=_TIMEOUT) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #e1adeaf7fbd9a4c0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/tradingview_mcp/core/services/extended_hours_service.py:162 
            resp = await client.get(_quote_url(symbol))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #5cde9f0bcf177a25 — Environment-variable access.
repo/src/tradingview_mcp/core/services/marketaux_service.py:55 
    limit = int(os.environ.get("MARKETAUX_DAILY_BUDGET", "90"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #85c34e99750c47e6 — Environment-variable access.
repo/src/tradingview_mcp/core/services/marketaux_service.py:79 
    token = os.environ.get("MARKETAUX_API_TOKEN", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #3a379b92df35356d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/tradingview_mcp/core/services/marketaux_service.py:90 
        with urllib.request.urlopen(req, timeout=_TIMEOUT) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #43ffefd49c0bd329 — Environment-variable access.
repo/src/tradingview_mcp/core/services/marketaux_service.py:202 
    if not os.environ.get("MARKETAUX_API_TOKEN"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8cd36bf808eed0e6 — Environment-variable access.
repo/src/tradingview_mcp/core/services/marketaux_service.py:239 
    if not os.environ.get("MARKETAUX_API_TOKEN"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #906b01859a0ce2b7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/tradingview_mcp/core/services/news_service.py:89 
            feed = feedparser.parse(feed_info["url"], agent=_FEED_USER_AGENT)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #ede8b70eab1c3fd2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/tradingview_mcp/core/services/options_service.py:86 
        opener.open("https://fc.yahoo.com/", timeout=_TIMEOUT)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #21e1c2b35805ac7e — Hardcoded external endpoint. Review what data is sent to this destination.
repo/src/tradingview_mcp/core/services/options_service.py:92 
    req = urllib.request.Request(
        "https://query2.finance.yahoo.com/v1/test/getcrumb",
        headers={"User-Agent": _UA, "Accept": "text/plain"},
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #18b7611551e34d5b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/tradingview_mcp/core/services/options_service.py:96 
    with opener.open(req, timeout=_TIMEOUT) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #738abbc596000def — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/tradingview_mcp/core/services/options_service.py:116 
        with opener.open(full, timeout=_TIMEOUT) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #b49bb000346945c0 — Environment-variable access.
repo/src/tradingview_mcp/core/services/proxy_manager.py:41 
        "host":    os.environ.get("PROXY_HOST", "p.webshare.io"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #92c43826e76ebe1b — Environment-variable access.
repo/src/tradingview_mcp/core/services/proxy_manager.py:42 
        "port":    os.environ.get("PROXY_PORT", "80"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #27a91d5205ed3377 — Environment-variable access.
repo/src/tradingview_mcp/core/services/proxy_manager.py:43 
        "prefix":  os.environ.get("PROXY_USERNAME_PREFIX", ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b8dfdd5c04a8a820 — Environment-variable access.
repo/src/tradingview_mcp/core/services/proxy_manager.py:44 
        "password": os.environ.get("PROXY_PASSWORD", ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ef4b1a8170f2e4cf — Environment-variable access.
repo/src/tradingview_mcp/core/services/proxy_manager.py:45 
        "enabled": os.environ.get("PROXY_ENABLED", "true").lower() == "true",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #40923e26d9b5b386 — Environment-variable access.
repo/src/tradingview_mcp/core/services/proxy_manager.py:46 
        "min":     int(os.environ.get("PROXY_SESSION_MIN", "1")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #809e810b8cb57f99 — Environment-variable access.
repo/src/tradingview_mcp/core/services/proxy_manager.py:47 
        "max":     int(os.environ.get("PROXY_SESSION_MAX", "250")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #8cd8c5badd324634 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/src/tradingview_mcp/core/services/proxy_manager.py:134 
        req = urllib.request.Request("https://ipinfo.io/json")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #8d338c6393c224d8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/tradingview_mcp/core/services/proxy_manager.py:135 
        with opener.open(req, timeout=12) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #daa6da2c95895b0a — Environment-variable access.
repo/src/tradingview_mcp/core/services/screener_provider.py:24 
        return max(1.0, float(_os.environ.get('TRADINGVIEW_MCP_SOCKET_TIMEOUT', '20')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e450e189fb20c309 — Environment-variable access.
repo/src/tradingview_mcp/core/services/screener_provider.py:91 
        return float(_os.environ.get('TRADINGVIEW_MCP_CACHE_TTL', '60'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9a7416895a40b80e — Environment-variable access.
repo/src/tradingview_mcp/core/services/screener_provider.py:98 
        return max(0.0, float(_os.environ.get('TRADINGVIEW_MCP_STALE_TTL', '21600')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #525c7da7814a5004 — Environment-variable access.
repo/src/tradingview_mcp/core/services/screener_provider.py:108 
    raw = _os.environ.get('TRADINGVIEW_MCP_RETRY_DELAYS', '1.0,4.0')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9e28f5029c666ec7 — Environment-variable access.
repo/src/tradingview_mcp/core/services/screener_provider.py:117 
        return max(0.0, min(1.0, float(_os.environ.get('TRADINGVIEW_MCP_RETRY_JITTER', '0.2'))))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e2b688d5c10eedfc — Environment-variable access.
repo/src/tradingview_mcp/core/services/screener_provider.py:141 
        return max(0.0, float(_os.environ.get('TRADINGVIEW_MCP_FAILURE_COOLDOWN_S', '15')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #39324355c49c6d30 — Environment-variable access.
repo/src/tradingview_mcp/core/services/screener_provider.py:242 
        return max(1, int(_os.environ.get('TRADINGVIEW_MCP_MAX_INFLIGHT', '2')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c869668bf9b88e42 — Environment-variable access.
repo/src/tradingview_mcp/core/services/screener_provider.py:252 
        return max(0.0, float(_os.environ.get('TRADINGVIEW_MCP_MIN_INTERVAL_S', '0.5')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #4cdbf0fecef50339 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/tradingview_mcp/core/services/screener_provider.py:524 
        resp = requests.post(url, json=payload, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #10531d46e58f0804 — Environment-variable access.
repo/src/tradingview_mcp/core/services/screener_service.py:71 
        return max(1, int(os.environ.get('TRADINGVIEW_MCP_BATCH_MAX_CONSECUTIVE_FAILS', '2')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ab352b112a676c2f — Environment-variable access.
repo/src/tradingview_mcp/core/services/screener_service.py:78 
        v = float(os.environ.get('TRADINGVIEW_MCP_BATCH_BUDGET_S', '30'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #c32b1c696ac52634 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/tradingview_mcp/core/services/sentiment_service.py:56 
        with opener.open(req, timeout=_TIMEOUT) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #c508313371b7763e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/tradingview_mcp/core/services/yahoo_finance_service.py:106 
    with opener.open(req, timeout=_TIMEOUT) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #e1c42f651307427e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/src/tradingview_mcp/core/services/yahoo_finance_service.py:154 
    resp = await client.get(_quote_url(symbol))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #8f94d34f7a159e2a — Environment-variable access.
repo/src/tradingview_mcp/server.py:1082 
    parser.add_argument("--host", default=os.environ.get("HOST", "127.0.0.1"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f5269dbe36ddc963 — Environment-variable access.
repo/src/tradingview_mcp/server.py:1083 
    parser.add_argument("--port", type=int, default=int(os.environ.get("PORT", "8000")))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #217e1a3c1de7aa94 — Environment-variable access.
repo/src/tradingview_mcp/server.py:1086 
    if os.environ.get("DEBUG_MCP"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

feedparser

python dependency
expand_more 10 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #b2ce67a390f9c9c0 — Filesystem access.
pkgs/python/[email protected]/docs/conf.py:7 
content = (pathlib.Path(__file__).parent.parent / 'feedparser/__init__.py').read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #1f0f5206c109d61e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/feedparser/api.py:115 
        return http.get(url_file_stream_or_string, etag, modified, agent, referrer, handlers, request_headers, result)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #43df2090904c1bea — Filesystem access.
pkgs/python/[email protected]/feedparser/api.py:119 
        with open(url_file_stream_or_string, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #e3f4b38f2eb49df3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/feedparser/http.py:171 
    f = opener.open(request)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #f7ca03a7b8ac9909 — Filesystem access.
pkgs/python/[email protected]/setup.py:36 
long_description = (root / 'README.rst').read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54ac1a5fa0ec4b80 — Environment-variable access.
pkgs/python/[email protected]/setup.py:39 
if os.getenv('NAME_SUFFIX'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #65f3679ef4bf55b2 — Environment-variable access.
pkgs/python/[email protected]/setup.py:40 
    name = f"{name}_{os.getenv('NAME_SUFFIX')}"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5b75dd208c9aabb — Filesystem access.
pkgs/python/[email protected]/setup.py:42 
content = (root / 'feedparser/__init__.py').read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #42201e6df98ad042 — Environment-variable access.
pkgs/python/[email protected]/setup.py:45 
if os.getenv('VERSION_SUFFIX'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #99ee422f5fc04c3d — Environment-variable access.
pkgs/python/[email protected]/setup.py:46 
    version = f"{version}rc{os.getenv('VERSION_SUFFIX')}"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

httpx

python dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #05e225e48f865b88 — Environment-variable access.
pkgs/python/[email protected]/httpx/_config.py:34 
        if trust_env and os.environ.get("SSL_CERT_FILE"):  # pragma: nocover

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #21279adf64d95edf — Environment-variable access.
pkgs/python/[email protected]/httpx/_config.py:35 
            ctx = ssl.create_default_context(cafile=os.environ["SSL_CERT_FILE"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8e066d5ede552611 — Environment-variable access.
pkgs/python/[email protected]/httpx/_config.py:36 
        elif trust_env and os.environ.get("SSL_CERT_DIR"):  # pragma: nocover

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #99f4a376218e4bc3 — Environment-variable access.
pkgs/python/[email protected]/httpx/_config.py:37 
            ctx = ssl.create_default_context(capath=os.environ["SSL_CERT_DIR"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

mcp

python dependency
expand_more 39 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #0cd690baa5c8793d — Environment-variable access.
pkgs/python/[email protected]/.github/actions/conformance/client.py:72 
    context_json = os.environ.get("MCP_CONFORMANCE_CONTEXT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #6e399dd35af6f39d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/.github/actions/conformance/client.py:118 
            response = await client.get(
                authorization_url,
                follow_redirects=False,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unreachable #d685875746323276 — Environment-variable access.
pkgs/python/[email protected]/.github/actions/conformance/client.py:281 
    context_json = os.environ.get("MCP_CONFORMANCE_CONTEXT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #71982bd53a2b3711 — Environment-variable access.
pkgs/python/[email protected]/.github/actions/conformance/client.py:349 
    scenario = os.environ.get("MCP_CONFORMANCE_SCENARIO")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #890ca874b044c904 — Environment-variable access.
pkgs/python/[email protected]/examples/clients/conformance-auth-client/mcp_conformance_auth_client/__init__.py:50 
    context_json = os.environ.get("MCP_CONFORMANCE_CONTEXT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #c7022d95af3a151d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/examples/clients/conformance-auth-client/mcp_conformance_auth_client/__init__.py:113 
            response = await client.get(
                authorization_url,
                follow_redirects=False,  # Don't follow redirects automatically
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unreachable #cd29b461667ad1ab — Environment-variable access.
pkgs/python/[email protected]/examples/clients/simple-auth-client/mcp_simple_auth_client/main.py:343 
    server_url = os.getenv("MCP_SERVER_PORT", 8000)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #42aa588a7b4747cb — Environment-variable access.
pkgs/python/[email protected]/examples/clients/simple-auth-client/mcp_simple_auth_client/main.py:344 
    transport_type = os.getenv("MCP_TRANSPORT_TYPE", "streamable-http")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #c3015485d5b246d2 — Environment-variable access.
pkgs/python/[email protected]/examples/clients/simple-auth-client/mcp_simple_auth_client/main.py:345 
    client_metadata_url = os.getenv("MCP_CLIENT_METADATA_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3ebb34f6e54c2d61 — Environment-variable access.
pkgs/python/[email protected]/examples/clients/simple-chatbot/mcp_simple_chatbot/main.py:24 
        self.api_key = os.getenv("LLM_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #cc26567a33baf103 — Filesystem access.
pkgs/python/[email protected]/examples/clients/simple-chatbot/mcp_simple_chatbot/main.py:45 
        with open(file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3e55716abd4947c6 — Environment-variable access.
pkgs/python/[email protected]/examples/clients/simple-chatbot/mcp_simple_chatbot/main.py:83 
            env={**os.environ, **self.config["env"]} if self.config.get("env") else None,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #875a4b6d15c7dcf1 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/examples/clients/simple-chatbot/mcp_simple_chatbot/main.py:251 
                response = client.post(url, headers=headers, json=payload)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unreachable #735a7b0cd792603a — Filesystem access.
pkgs/python/[email protected]/examples/fastmcp/icons_demo.py:14 
icon_data = base64.standard_b64encode(icon_path.read_bytes()).decode()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #02357a6f1b8c4b79 — Environment-variable access.
pkgs/python/[email protected]/examples/fastmcp/memory.py:52 
PROFILE_DIR = (Path.home() / ".fastmcp" / os.environ.get("USER", "anon") / "memory").resolve()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unreachable #f5c4de790ec95840 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/examples/fastmcp/text_me.py:49 
        response = client.post(
            "https://api.surgemsg.com/messages",
            headers={
                "Authorization": f"Bearer {surge_settings.api_key}",
                "Surge-Account": surge_settings.account_id,
                "Content-Type": "application/json",
            },
            json={
                "body": text_content,
                "conversation": {
                    "contact": {
                        "first_name": surge_settings.my_first_name,
                        "last_name": surge_settings.my_last_name,
                        "phone_number": surge_settings.my_phone_number,
                    }
                },
            },
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unreachable #5b050df5d8f94533 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/examples/servers/simple-auth/mcp_simple_auth/token_verifier.py:53 
                response = await client.post(
                    self.introspection_endpoint,
                    data={"token": token},
                    headers={"Content-Type": "application/x-www-form-urlencoded"},
                )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unreachable #c859276fbb66fadd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/examples/servers/simple-tool/mcp_simple_tool/server.py:16 
        response = await client.get(url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unreachable #b5ea24da63c20b2e — Environment-variable access.
pkgs/python/[email protected]/examples/snippets/clients/completion_client.py:17 
    env={"UV_INDEX": os.environ.get("UV_INDEX", "")},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #74af00a6028c1c76 — Environment-variable access.
pkgs/python/[email protected]/examples/snippets/clients/display_utilities.py:17 
    env={"UV_INDEX": os.environ.get("UV_INDEX", "")},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #383d36fdcb403c80 — Environment-variable access.
pkgs/python/[email protected]/examples/snippets/clients/stdio_client.py:19 
    env={"UV_INDEX": os.environ.get("UV_INDEX", "")},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #683f5b3511f1b2a4 — Filesystem access.
pkgs/python/[email protected]/examples/snippets/servers/binary_resources.py:9 
    with open("logo.png", "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #45932573c814cf24 — Filesystem access.
pkgs/python/[email protected]/examples/snippets/servers/embedded_resource_results.py:10 
    with open(path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #1dbd876698cae791 — Filesystem access.
pkgs/python/[email protected]/examples/snippets/servers/embedded_resource_results_binary.py:12 
    with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #fbde72dd99d271a5 — Filesystem access.
pkgs/python/[email protected]/examples/snippets/servers/prompt_embedded_resources.py:11 
    file_content = open(filename).read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #02a7a8149289f33a — Filesystem access.
pkgs/python/[email protected]/examples/snippets/servers/tool_errors.py:27 
    with open(path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e5019081495f98f9 — Filesystem access.
pkgs/python/[email protected]/scripts/update_doc_snippets.py:53 
        code = file.read_text().rstrip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6dacda4ad2716e46 — Filesystem access.
pkgs/python/[email protected]/scripts/update_doc_snippets.py:109 
    content = doc_path.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #48e9a8ec179a37bb — Filesystem access.
pkgs/python/[email protected]/scripts/update_doc_snippets.py:134 
            doc_path.write_text(updated_content)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d70a9f67daae53f5 — Environment-variable access.
pkgs/python/[email protected]/src/mcp/cli/claude.py:24 
        path = Path(os.environ.get("XDG_CONFIG_HOME", Path.home() / ".config"), "Claude")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f0b9646d42ff8536 — Filesystem access.
pkgs/python/[email protected]/src/mcp/cli/claude.py:77 
            config_file.write_text("{}")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #df0bddbec325fcf3 — Filesystem access.
pkgs/python/[email protected]/src/mcp/cli/claude.py:88 
        config = json.loads(config_file.read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a65e45087c94a472 — Filesystem access.
pkgs/python/[email protected]/src/mcp/cli/claude.py:135 
        config_file.write_text(json.dumps(config, indent=2))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f415a53517643601 — Environment-variable access.
pkgs/python/[email protected]/src/mcp/cli/cli.py:282 
            env=dict(os.environ.items()),  # Convert to list of tuples for env update

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #47d036f2589e81c6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/src/mcp/client/sse.py:138 
                                    response = await client.post(
                                        endpoint_url,
                                        json=session_message.message.model_dump(
                                            by_alias=True,
                                            mode="json",
                                            exclude_none=True,
                                        ),
                                    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #69446ac4bb22ff8a — Environment-variable access.
pkgs/python/[email protected]/src/mcp/client/stdio/__init__.py:59 
        value = os.environ.get(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #990464ae3071b596 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/src/mcp/server/fastmcp/resources/types.py:161 
            response = await client.get(self.url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #0ef8e96a2679496c — Filesystem access.
pkgs/python/[email protected]/src/mcp/server/fastmcp/utilities/types.py:47 
            with open(self.path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a412c9185d587ce9 — Filesystem access.
pkgs/python/[email protected]/src/mcp/server/fastmcp/utilities/types.py:94 
            with open(self.path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

requests

python dependency
expand_more 8 low-confidence finding(s)
low env_fs dependency Excluded from app score #aecb0b3af958079b — Environment-variable access.
pkgs/python/[email protected]/src/requests/sessions.py:857 
                    os.environ.get("REQUESTS_CA_BUNDLE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3002d1486a790f3f — Environment-variable access.
pkgs/python/[email protected]/src/requests/sessions.py:858 
                    or os.environ.get("CURL_CA_BUNDLE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81aa2e4c3c72180b — Environment-variable access.
pkgs/python/[email protected]/src/requests/utils.py:239 
    netrc_file = os.environ.get("NETRC")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b15a73eb5bf14e30 — Environment-variable access.
pkgs/python/[email protected]/src/requests/utils.py:798 
        old_value = os.environ.get(env_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4cbec8f34fd063b2 — Environment-variable access.
pkgs/python/[email protected]/src/requests/utils.py:799 
        os.environ[env_name] = value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4098eb41f2946fdd — Environment-variable access.
pkgs/python/[email protected]/src/requests/utils.py:805 
                del os.environ[env_name]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9ec20b7549be5f2d — Environment-variable access.
pkgs/python/[email protected]/src/requests/utils.py:807 
                os.environ[env_name] = old_value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e7fbfcf4136186ce — Environment-variable access.
pkgs/python/[email protected]/src/requests/utils.py:820 
        return os.environ.get(key) or os.environ.get(key.upper())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

tradingview-screener

python dependency
expand_more 1 low-confidence finding(s)
low egress dependency Excluded from app score #abf9dd9cb4aa8ad1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/src/tradingview_screener/query.py:594 
        r = requests.post(self.url, json=self.query, **kwargs)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

tradingview-ta

python dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #075a2718816ed0a8 — Filesystem access.
pkgs/python/[email protected]/setup.py:3 
with open("README.md", "r") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #ee66f9bd84acdced — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/tradingview_ta/main.py:107 
        req = requests.post(
            "https://symbol-search.tradingview.com/symbol_search", params={"text": text, "type": type})

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #08b5158ca25d66df — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/tradingview_ta/main.py:353 
        response = requests.post(
            scan_url, json=data, headers=headers, timeout=self.timeout, proxies=self.proxies)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e694b74fadfe4f5a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/tradingview_ta/main.py:421 
    response = requests.post(
        scan_url, json=data, headers=headers, timeout=timeout, proxies=proxies)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.