DO NOT open public GitHub issues for security vulnerabilities.

Instead, please report security issues by opening a private security advisory at: https://github.com/ChrisSc/mcp_polygon/security/advisories/new

Or email security concerns to: clscragg@protonmail.com

When reporting a security issue, please include:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact assessment
• Suggested fix (if available)

• Critical vulnerabilities: Hotfix release within 48 hours
• High severity: Patch release within 7 days
• Medium/Low severity: Included in next scheduled release

We follow a 90-day disclosure timeline:

1. Issue reported privately
2. Fix developed and tested
3. Security patch released
4. Public disclosure after patch is available
5. Credit given to reporter (unless anonymity requested)

• Never commit your POLYGON_API_KEY to version control
• Use environment variables for API key storage
• Rotate API keys quarterly
• Use read-only API keys if Polygon.io supports scoped permissions

When installing this MCP server:

1. Verify the source:

   # Always install from specific version tags
   uvx --from git+https://github.com/ChrisSc/mcp_polygon@v1.0.0 mcp_polygon

2. Review changes before upgrading:

   # Check what changed between versions
   git diff v1.0.0..v1.1.0

3. Monitor API usage for anomalies at polygon.io dashboard

• Keep dependencies updated (uv sync)
• Run in isolated environments (virtual env, Docker)
• Use .env files for local development (never commit them)

This MCP server is a stateless proxy:

• ✅ No data storage or caching
• ✅ No authentication logic (delegated to Polygon.io)
• ✅ Read-only operations only
• ✅ No user data collection
• ✅ All API calls go through official Polygon.io SDK

We use:

• mcp[cli] - Official MCP Python SDK (modelcontextprotocol.io)
• polygon-api-client - Official Polygon.io Python SDK

All dependencies are pinned in uv.lock with SHA256 hashes.

For security-related questions or concerns:

• GitHub Security Advisories: https://github.com/ChrisSc/mcp_polygon/security/advisories
• Fork Maintainer: Chris Scragg (@ChrisSc) - clscragg@protonmail.com
• Upstream Security: For Polygon.io API security, contact support@polygon.io