Is Korea Stock MCP server safe?

The component can run operating-system commands or spawn processes.

while ((match = titleRegex.exec(xml)) !== null) {

while ((m = idRegex.exec(xml)) !== null) {

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.

package.json has a 'prepare' script (runs on git/local installs and before publishing).

"prepare": "npm run build",

Why it matters: Usually a build step, but confirm it doesn't fetch or run remote code.

Fix: Usually a legitimate build step; confirm it only builds and does not fetch or execute remote code.

The component makes outbound network requests.

const response = await fetch(url);

const response = await fetch(PROXY_URL, { signal: controller.signal });

const response = await fetch(

const response = await fetch(url, {

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.

An MCP tool surface (manifest or tool definitions) was found.

{

Why it matters: Just context — review which tools it offers and their permissions.

Fix: Review the declared MCP tools and their permissions.