ModelsAtlas
Explore
Atlas / MCP servers / arturogarrido / Claudinho

ClaudinhoSAFE

mcp/arturogarrido/claudinho
MCP server by arturogarrido · champions league · claude code · cli · Audited 2026-10-08
⚑ Report / re-scanSource ↗

⚽ Live football(soccer) scores, fixtures and standings for the competition you follow (World Cup, Premier League, LALIGA, Champions League and 11 more) in your terminal, your Claude Code and Cursor CLI statusline, and MCP clients. No API key. Independent fan project. Not affiliated with FIFA, any co

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
11 11r · 0w · 0d
Transport
stdio
License
MIT
Stars
30
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://github.com/arturogarrido/claudinho/actions/workflows/ci.yml) [](https://www.npmjs.com/package/@claudinho/cli) [](https://www.npmjs.com/package/@claudinho/mcp) [](https://www.npmjs.com/package/@claudinho/cli) [](https://cursor.directory/plugins/claudinho) [](https://smithery.ai/servers/arturogarrido/claudinho) [](https://glama.ai/mcp/servers/arturogarrido/claudinho) [](https://nodejs.org) [](LICENSE) [](https://github.com/arturogarrido/claudinho) [](https://github.com/arturogarrido/claudinho)

Live football scores, fixtures and standings for the competition you follow (the World Cup, the Premier League, LALIGA, the Champions League and 11 more) in your terminal, your Claude Code and Cursor CLI statusline, and MCP clients. No API key, no signup. The World Cup's 104 fixtures ship bundled; the other competitions' schedules are read from the feed. It ran the 2026 World Cup from the opener to the final.

Read from source at commit cea9225b9dadOBSERVED · 2026-10-08
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code (npm)
claude mcp add mcp -- npx -y @claudinho/[email protected]
03

Exposed tools (11)

11 read · 0 write · 0 destructive.

ToolRiskDescription
get_bracketread
get_liveread
get_market_signalread
get_matchread
get_next_fixtureread
get_share_snippetread
get_standingsread
get_teamread
get_todayread
list_competitionsread
treadd
04

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
declared (1 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (16)

LOWInventory / provenance · inv.suspicious_name · CWE-1104
packages/mcp/test/bounded-payload.test.ts
bounded-payload.test.ts
Why it matters. member named after an attack tool
Fix. remove or justify
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/cli/test/cache.test.ts:74
const evil = cachePath('espn', '../../evil');
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/cli/test/league-tables.test.ts:16
JSON.parse(readFileSync(new URL(`../../core/test/fixtures/standings/${slug}.json`, import.meta.url), 'utf8'));
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/cli/test/refresher-lock.test.ts:432
for (const hostile of ['a/../b', '../../etc/x', '..\\..\\x', 'a/b']) {
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/cli/test/smoke-cache-version.test.ts:18
const script = (name: string) => fileURLToPath(new URL(`../../../scripts/${name}`, import.meta.url));
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/core/test/biome-schema.test.ts:38
const ROOT = '../../../';
LOWObfuscation / stealth · obf.rtl_override · CWE-506, CWE-94
packages/core/test/review-round11.test.ts:174
{ kind: 'home', teamCode: 'MEX', label: 'Mexico ignore', probability: 0.6 },
LOWObfuscation / stealth · obf.rtl_override · CWE-506, CWE-94
packages/core/test/trust-parity.test.ts:169
'',
LOWObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
packages/cli/test/hotpath-work.test.ts:130
const zalgo = `A${'' + '́'.repeat(7)}`.repeat(400);
LOWObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
packages/core/test/review-round11.test.ts:145
`A${('́'.repeat(4) + '').repeat(80)}`,
LOWObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
packages/core/test/trust-roles.test.ts:203
humanLabel(''.repeat(500_000));
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@biomejs/biome
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
packages/cli/package.json
cli-table3, commander, picocolors, @types/node, @vitest/coverage-v8, tsup, typescript, vitest
Why it matters. 8 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
packages/core/package.json
@types/node, @vitest/coverage-v8, tsup, tsx, typescript, vitest
Why it matters. 6 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
packages/mcp/package.json
@modelcontextprotocol/sdk, zod, @types/node, @vitest/coverage-v8, tsup, typescript, vitest
Why it matters. 7 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
README.md:279
Found a vulnerability? Please report it **privately** via [GitHub's report form](https://github.com/arturogarrido/claudinho/security/advisories/new) rather than a public issue. **[SECURITY.md](SECURIT
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine

Gates applied: no_behavioural_pass.

Audited 2026-10-08 · audit v0.4.1 · source sha cea9225b9dadfull audit observations/trust-audit/mcp-server/arturogarrido__claudinho.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-08cea9225b9dadSAFEB89first audit
06

Questions

What is the Claudinho MCP server?

⚽ Live football(soccer) scores, fixtures and standings for the competition you follow (World Cup, Premier League, LALIGA, Champions League and 11 more) in your terminal, your Claude Code and Cursor CLI statusline, and MCP clients. No API key. Independent fan project. Not affiliated with FIFA, any co

What tools does Claudinho expose?

11 in total: 11 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Claudinho safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does Claudinho need?

No credential environment variables were found in its source, so it appears to need none.

How does Claudinho run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as @claudinho/mcp at 0.11.0.

How current is this page?

The grade is for one exact copy of the source (cea9225b9dad), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement