TKB Picks MCP
MCP server that wraps SportsGameOdds and BALLDONTLIE APIs to provide sports scheduling, odds, injuries, and team statistics tools for building TKB Picks threads.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
tylerbody
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
tkb_debug_raw_eventTEMPORARY diagnostic tool. Returns the raw, unprocessed SGO event JSON for direct field inspection. Use this to verify real field names against live data, not for normal thread-building use.
tkb_debug_raw_injuriesTEMPORARY diagnostic tool. Returns raw, unprocessed BALLDONTLIE injuries JSON (first 3 records) for direct field inspection. Use this to find the real team-field shape, not for normal use.
tkb_get_player_hit_rateCheck how often a player has cleared a specific stat line across their recent games. This pulls the player's team's recent finalized games and reads the player's actual stat value from each one, so the result is a REAL counted sample - never a fixed window and never padded/estimated. Games where th…
tkb_get_injuriesGet current injury reports from BALLDONTLIE for a sport, optionally filtered by player or team. This is a structured injury data source (not a web search) - use it as the FIRST check before including any player in a pick. It returns status (Out/Questionable/ Doubtful/etc.), a dated description, and…
tkb_get_oddsGet current odds/lines for a game - moneyline, spread, total, or an individual player's over/under prop. Uses exact market construction (not fuzzy text matching), so results are precise - e.g. asking for "Hits" won't accidentally also return "Hits Allowed" or "Hits + Runs + RBIs". Args: - sport, …
tkb_get_period_oddsGet moneyline/spread/total odds for a specific PERIOD of a game rather than the full event - first half, first 5 innings, a specific quarter, etc. Args: - sport, eventID - period: e.g. "1st_half", "1st_5_innings", "3rd_quarter". Valid periods differ by sport - MLB uses innings-based periods…
tkb_get_scheduleGet the game schedule for a sport, with flexible date and filtering options. Args: - sport ('mlb'|'wnba'|'nfl'|'cfb'): which sport - date (string, optional): single date YYYY-MM-DD - startsAfter / startsBefore (ISO datetime, optional): date range instead of single date - teamName (string, o…
tkb_get_team_splitGet a team's home record, road record, or record against a specific opponent. Computed from real finalized game results (not a season-averages shortcut), so it reflects actual wins/losses in the requested split. Args: - sport, teamID, teamName - splitType ('home'|'road'|'opponent') - opponen…
tkb_get_team_recordGet a team's overall season record (wins, losses, streak, last 5) directly from SGO's real standings data - fast, single call, no event-tallying involved. This is DIFFERENT from tkb_get_team_split, which computes home/road/opponent-specific splits by tallying individual games (standings data doesn'…
tkb_get_yes_no_propGet odds for a Yes/No "milestone" bet - did the player/team do X at all this game (not an over/under line). Examples: first touchdown, any home run, double-double, pitching win, defensive safety. This is DIFFERENT from tkb_get_odds, which handles over/under lines. Use this tool specifically for mil…
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
BDL_API_KEYSGO_API_KEY=xxx =xxx npm startSGO_API_KEYxxx BDL_API_KEY=xxx npm startPORTTool inputs are validated
Only 0/10 tool handlers declare input schemas (0%)
Declare an inputSchema with zod/joi/yup on every tool definition.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 16 high severity in production deps — @modelcontextprotocol/sdk@1.12.0 (high), @modelcontextprotocol/sdk@1.12.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/tylerbody/tkb-picks-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check