yahoo-fantasy-football-mcpBLOCK
MCP server for Yahoo Fantasy Football: format-aware, deeply reasoned roster, waiver, trade and start/sit recommendations grounded in your league's real scoring, cross-referenced with NFL usage, injury, betting and news context. Ships with expert Skills. Node/TypeScript.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
🏈 Yahoo Fantasy Football MCP Server
Format-aware, deeply reasoned fantasy-football recommendations for Claude — read-only first, a human confirms every write, and news is data, never instructions.
= 24.15" src="https://img.shields.io/badge/node-%3E%3D24.15-339933?logo=node.js&logoColor=white">
Phase 1a is built and tested (2026-09-30). The server runs today on your own league file (league.yaml, kept outside the repo) plus free nflverse and weather data: 19 tools, 7 resources, 3 prompts, 4 Skills and theffCLI — 3,867 unit and 127 process tests, a QA + penetration-test round whose 80 confirmed findings are all fixed (register). Yahoo is not connected: Yahoo's Fantasy API is application-gated and read-only, and this build has no API access, so nothing here logs in to Yahoo or changes your roster — every recommen
fb3a4e220275OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add fantasy-football-mcp -- npx -y [email protected]
{
"mcpServers": {
"fantasy-football-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (4)
3 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
ff_boom | read | |
ff_debug_echo | read | |
ff_probe | read | |
start-sit | write | Decides things: with a colon |
Trust audit
BLOCKgrade F · trust 51/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
message: "node:vm evaluates code — banned like eval (plan 02 §7).",
const FORBIDDEN_TEXT_RE = /[\u0000-\u001f\u007f-\u009f---]/u;
- **What** Under ManualLeagueProvider, the status "A" player universe includes every nflverse roster_weekly player, not only the players in league.yaml. Their names come from the nflverse:roster_weekl
"no opponent for this week (no opponents entry, or his players are missing): P(win) is not reported; ΔP(win) is against an evenly matched opponent",
const FORBIDDEN_TEXT_RE = /[\u0000-\u001f\u007f-\u009f---]/u;
const SECRET = "fake-odds-value-0123456789";
injuries_2025.parquet
injuries_2026.parquet
games.excerpt.parquet
stats_player_week_2026.parquet
roster_weekly_2026.excerpt.parquet
.gitleaks.toml
.prettierignore
.docs-check-skip
[`export const f = new Function("return 1");`, "no-new-func"],"The server refuses ~/.ssh, but not {X}.","Only ~/.ssh is refused; {X} is not.",import type { NflTeam } from "../../config/schema.js";import { freshnessClass, stampState } from "../../config/freshness.js";import type { NflTeam } from "../../config/schema.js";import type { NflTeam } from "../../config/schema.js";import { freshnessClass, stampState } from "../../config/freshness.js";Fixed port (`FF_AUTH_PORT`, default **8765 [A-2]**), bound to `127.0.0.1`, self-signed certificate generated once into `<config>/auth-cert/` (via the system `openssl` binary — macOS ships one; Node ha
| A-4 | Binding both `127.0.0.1` and `::1` is needed for `localhost` callbacks | try with a browser; if Yahoo accepts `https://127.0.0.1:port` the IPv6 bind is unnecessary (03 §F.3) |
["https://140.82.112.3/x", "host_not_allowed"],
Gates applied: instruction_override, no_behavioural_pass.
fb3a4e220275full audit observations/trust-audit/mcp-server/chadpapineau__yahoo-fantasy-football-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | fb3a4e220275 | BLOCK | F | 51 | first audit |
Questions
What is the yahoo-fantasy-football-mcp MCP server?
MCP server for Yahoo Fantasy Football: format-aware, deeply reasoned roster, waiver, trade and start/sit recommendations grounded in your league's real scoring, cross-referenced with NFL usage, injury, betting and news context. Ships with expert Skills. Node/TypeScript.
What tools does yahoo-fantasy-football-mcp expose?
4 in total: 3 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is yahoo-fantasy-football-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (51/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does yahoo-fantasy-football-mcp need?
No credential environment variables were found in its source, so it appears to need none.
How does yahoo-fantasy-football-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as fantasy-football-mcp at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (fb3a4e220275), read on 2026-10-11. The repository is watched and re-audited when it changes.