Fantasy FootballBLOCK
Yahoo Fantasy Football MCP server for Claude Desktop - Advanced lineup optimization, draft assistance, and league management. Built using Claude Code.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A personal, single-user Model Context Protocol (MCP) server for Yahoo Fantasy Football. It exposes league, roster, matchup, waiver-wire, draft, and lineup-analysis data to AI clients while keeping the underlying fantasy data source separate from the model.
Current status
This project is built and run as a single-user app: you supply your own Yahoo developer credentials and tokens, and the server serves your leagues to your MCP client. It is not intended to be deployed by someone else as a shared, multi-user service.
Experimental hosted, multi-user development lives on the `multi-user-app` branch. See its roadmap for planned work toward a possible ChatGPT app. That branch is not a ready-to-deploy shared service; use main for personal use.
Note that Yahoo Fantasy Sports API access now requires manual approval from Yahoo, and Yahoo currently provides read access only. Write actions such as adding/dropping players or changing lineups are therefore not part of the tool surface.
Core capabilities
- Multi-league Yahoo fantasy football discovery
- League settings and standings
- Team rosters and weekly matchups
- Free-agent and waiver-wire research
- Team comparisons
- Draft rankings, recommendations, and draft-state analysis
- Lineup optimization
- Optional external player-context/enrichment integrations
MCP tools
The main FastMCP server currently exposes:
ff_get_leaguesff_get_league_infoff_get_standingsff_get_rosterff_get_matchupff_get_playersff_compare_teamsff_build_lineupff_get_draft_resultsff_get_waiver_wireff_get_draft_rankingsff_get_draft_recommendationff_analyze_draft_stateff_analyze_reddit_sentiment
The server also contains maintenance tools used for lo
a03347131dc1OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add fantasy-football-mcp --env LLM_MAX_TOKENS=${LLM_MAX_TOKENS} --env OPENAI_API_KEY=${OPENAI_API_KEY} --env REDDIT_CLIENT_SECRET=${REDDIT_CLIENT_SECRET} --env YAHOO_ACCESS_TOKEN=${YAHOO_ACCESS_TOKEN} -- uvx fantasy-football-mcp{
"mcpServers": {
"fantasy-football-mcp": {
"command": "uvx",
"args": [
"fantasy-football-mcp"
],
"env": {
"LLM_MAX_TOKENS": "${LLM_MAX_TOKENS}",
"OPENAI_API_KEY": "${OPENAI_API_KEY}",
"REDDIT_CLIENT_SECRET": "${REDDIT_CLIENT_SECRET}",
"YAHOO_ACCESS_TOKEN": "${YAHOO_ACCESS_TOKEN}"
}
}
}
}Exposed tools (18)
16 read · 1 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
ff_analyze_draft_state | read | Analyze current draft state including roster needs and strategic insights |
ff_analyze_reddit_sentiment | write | Analyze Reddit sentiment for fantasy football players to help with Start/Sit decisions |
ff_build_lineup | read | Build optimal lineup from your roster using strategy-based optimization and positional constraints |
ff_clear_cache | destructive | Clear the API response cache |
ff_compare_teams | read | Compare two teams |
ff_get_api_status | read | Get Yahoo API rate limit status and cache statistics |
ff_get_draft_rankings | read | Get pre-draft player rankings and ADP (Average Draft Position) |
ff_get_draft_recommendation | read | Get AI-powered draft recommendations for live fantasy football drafts |
ff_get_draft_results | read | Get draft results showing all teams with their draft positions and grades |
ff_get_league_info | read | Get detailed information about a specific league |
ff_get_leagues | read | Get all your fantasy football leagues |
ff_get_matchup | read | Get matchup for a specific week in a league |
ff_get_players | read | Get available free agent players in a league |
ff_get_roster | read | Get your team roster in a specific league |
ff_get_standings | read | Get standings for a specific league |
ff_get_teams | read | Get all teams in a specific league with basic information |
ff_get_waiver_wire | read | Get top available waiver wire players with detailed stats and projections |
ff_refresh_token | read | Refresh the Yahoo API access token when it expires |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (7)
cached_entry = pickle.load(f)
__import__(package.replace('-', '_'))ff_clear_cache
return hashlib.md5(full_string.encode()).hexdigest()
return hashlib.md5(endpoint.encode()).hexdigest()
return hashlib.md5(endpoint.encode()).hexdigest()
return hashlib.md5(endpoint.encode()).hexdigest()
Gates applied: no_behavioural_pass.
a03347131dc1full audit observations/trust-audit/mcp-server/derekrbreese__fantasy-football.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | a03347131dc1 | BLOCK | D | 69 | first audit |
Questions
What is the Fantasy Football MCP server?
Yahoo Fantasy Football MCP server for Claude Desktop - Advanced lineup optimization, draft assistance, and league management. Built using Claude Code.
What tools does Fantasy Football expose?
18 in total: 16 read-only, 1 that write, and 1 that can delete or overwrite (ff_clear_cache). Every one is listed on this page with its risk.
Is Fantasy Football safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Fantasy Football need?
It reads LLM_MAX_TOKENS, OPENAI_API_KEY, REDDIT_CLIENT_SECRET, YAHOO_ACCESS_TOKEN, YAHOO_CLIENT_SECRET and YAHOO_REFRESH_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Fantasy Football run?
It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as fantasy-football-mcp.
How current is this page?
The grade is for one exact copy of the source (a03347131dc1), read on 2026-10-08. The repository is watched and re-audited when it changes.