An MCP server that answers football questions with interactive widgets, centered on the 2026 FIFA World Cup using SofaScore API data.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate
vite: `server.fs.deny` bypass on Windows alternate paths
process.env. You'll be asked to provide them before it can run.ESPN_ONLY— 1 skips SofaScore entirely and serves everything from the ESPN fallback. Handy on hosts where SofaScore is always blocked (avoids the per-request probe + cooldown).HTTPS_PROXY— SOFA_PROXY Outbound HTTP(S) forward proxy for all SofaScore fetches (data + images). Point at a residential / unblocked proxy to defeat the Varnish/IP block. Falls back to .PORT— HTTP port (default 3000).PUBLIC_BASE_URL— window.__SOFA_BASE__ (from ) into each widget's <head>, andSOFA_MOCK— Point an MCP client at http://localhost:3000/mcp, or run with =1 toSOFA_PROXY— Outbound HTTP(S) forward proxy for all SofaScore fetches (data + images). Point at a residential / unblocked proxy to defeat the Varnish/IP block. Falls back to HTTPS_PROXY.https_proxy[](https://m8ven.ai/mcp/tejasq-sofascore-mcp-9yfpr2)