io.github.cyanheads/sports-mcp-server

Fetch live scores, schedules, standings, and team or player data.

Source

Official Registry

Updated

2026-06-13

// securityCaution

Requires keys· THESPORTSDB_API_KEY, MCP_LOG_LEVEL
Runs locally
Official / curated
Open source
Community-trusted

Summary

Overall this is an open-source MCP tool from an official registry with recent activity, which lowers supply-chain risk. The main concerns are required API credentials and local code execution; no explicit remote egress endpoint or unusual privilege red flags are shown, so overall it is caution.

CredentialsCaution

Requires THESPORTSDB_API_KEY, which is a sensitive API credential; if exposed via logs, config, or environment variables, it could be abused to query the sports data API. MCP_LOG_LEVEL is a logging control, not a secret.

Network egressLow risk

No remote endpoint host is provided, and no explicit data-exfiltration destination is shown; it is only implied that it would contact its declared sports data API, but no concrete egress host is listed.

Code executionCaution

System checks mark executes-code, meaning the tool runs code/processes locally. This is a normal MCP capability, but it still creates a local execution surface and should be run with least privilege.

Data accessLow risk

The description only states it retrieves scores, schedules, standings, and team/player data. No file I/O, browser takeover, or other local data access is indicated, so no overbroad access is shown in the material.

Supply chainCaution

The source is an official registry entry with an open-source repo and recent updates, which are positive signals. However, the license is undeclared and community adoption is 0 stars, so auditability and ecosystem confidence remain limited, keeping it at caution.

Recommendations

Run it in an isolated environment with least-privilege API keys.
Avoid exposing THESPORTSDB_API_KEY in logs, screenshots, or shared configs.
If it connects to the network, verify the actual sports data endpoints match expectations.
Review the source code and dependency lockfiles before production use.

Audited by: gpt-5.4 · 2026-06-17

// install

Copy the install command and let the AI configure it · recommended for beginners

Please install the "io.github.cyanheads/sports-mcp-server" MCP server from askskill:
Run: claude mcp add 'io-github-cyanheads-sports-mcp-server' -- npx -y @cyanheads/sports-mcp-server