BeaconIntel
← All MCP servers
MCP server

io.github.vdalhambra/financekit-mcp

mcp:vdalhambra/financekit-mcp

Stock quotes, technical analysis, crypto prices, and portfolio insights for AI agents

awesome-mcp-serversGlamaMCP Registry
Verdict
Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 26, 2026, 12:12 UTC at 08da618
2
findings
high
highest severity
1
threat classes
36
files scanned
447/447
checks satisfied
0
package advisories

Why this verdict

  • suspicious: finding mcp-server:.:smithery.yaml:8:SUPPLY
  • suspicious: finding mcp-server:.:smithery.yaml:9:SUPPLY

Security findings 2

Supply chain

highContextual risklow confidence

The Smithery launch config runs the server via uvx from an unpinned GitHub git URL (no tag or commit), so whatever is on the default branch at launch time is executed, unlike the pinned PyPI package declared in server.json.

smithery.yaml:8
git+https://github.com/vdalhambra/financekit-mcp.git
conceal:remotevector:metadata
Counter-argument considered

The launch command runs uvx from an unpinned GitHub default branch, which is a genuine supply-chain weakness. The repo is the same project as the server, so it is plausible self-hosting. That lowers severity but is not a carve-out, because it is not a pinned official-registry install. No evidence refutes it.

Supply chain

mediumContextual risklow confidence

The Smithery launch config runs the server via uvx straight from an unpinned git repository (no commit/tag), so whatever is on the default branch at launch time executes.

smithery.yaml:9
args: ['--from', 'git+https://github.com/vdalhambra/financekit-mcp.git', 'financekit'],
vector:metadata
Counter-argument considered

This is a duplicate of the first finding. The launch fetches and executes unpinned git HEAD, and nothing in the config pins or mitigates it.