Announcing Beacon: Self-improving memory for coding agents
BeaconIntel
2.9K
← All MCP servers
MCP server

io.github.xsf0221/pattern-vista

mcp:xsf0221/pattern-vista-cli

End-of-day US equity data: MA200 deviation rankings, market breadth, chart-pattern win rates.

awesome-mcp-serversGlamaMCP Registry
Verdict
No issues found

No suspicious or malicious behavior was found.

Analyzed Oct 26, 2026, 13:03 UTC at f6a984d

Dispute security verdict

If you believe this verdict is incorrect, submit a dispute and we'll review it.

0
findings
—
highest severity
0
threat classes
19
files scanned
182/182
checks satisfied
0
package advisories

Why this verdict

  • benign: 182 checks satisfied, no findings for mcp-server:.

Security findings 0

No security findings

No suspicious or malicious behavior was found; 2 candidate findings were refuted on review.
Refuted findings 2

Candidates the review stage examined and rejected, kept for transparency.

Data exfiltration

highRefutedlow confidence

The backend URL that receives the user's Pattern Vista API key in every RPC body can be redirected through an undeclared environment variable (PATTERN_VISTA_SUPABASE_URL); the code comments call it a staging override, so it is plausibly honest, but a process environment that sets it would receive the key.

src/pattern_vista/constants.py:16-19
PATTERN_VISTA_SUPABASE_URL
Why it was refuted

The URL override is openly documented in the module docstring as a staging/development setting, so it is not concealed. Exploiting it needs an attacker who already controls the process environment, and no agent instruction or source-to-sink chain redirects the key.

Credential access

highRefutedlow confidence

The backend base URL is overridable via the PATTERN_VISTA_SUPABASE_URL environment variable, and the client then POSTs the user's api_key (from env or config file) to that host; if an attacker controls the environment, the key is redirected to an arbitrary server.

src/pattern_vista/constants.py:17
"PATTERN_VISTA_SUPABASE_URL"
Why it was refuted

This is the same documented base-URL override. Redirecting the api_key requires prior control of the environment, which also exposes PATTERN_VISTA_API_KEY directly. Nothing conceals the override or instructs the agent to set it.