MCP server for Transfer Market data access via worldfootballR R package integration
Server has 8 tools with basic schemas and descriptions, but significant quality gaps. All tools have descriptions (10-80 chars, mostly under 100), which is positive. However, parameter descriptions are minimal or missing context. Input schemas are present but lack detail: no enums for constrained values (e.g., staff_role, transfer_window, debut_type), no min/max for numeric params, no format specs. Output schemas are completely undocumented, tools return stringified R results or file paths, not structured data. Error handling is absent; execute_r_function() catches exceptions but returns raw tracebacks to the LLM. No guidance on retryability, user-fixable errors, or recovery paths. Tool names follow verb_noun pattern (good), but parameter naming is inconsistent: 'country_name' vs 'league_url', 'start_year' vs 'debut_start_year'. No pagination support despite tools returning lists. Security: R code is constructed via string interpolation, vulnerable to injection if user-controlled inputs are not sanitized.
Get players with expiring contracts from Transfermarkt.
Get league debutants from Transfermarkt.
Get current injuries in a league from Transfermarkt.
Get league table for specific matchday(s) from Transfermarkt.
Get player URLs for a specific team from Transfermarkt.
Get staff URLs for specific teams and staff role from Transfermarkt.
Get transfer activity for a team from Transfermarkt.
No output schemas documented. All tools return stringified R results or file paths (e.g., 'r_result_<timestamp>.csv'). LLMs cannot parse or chain results. Violates pattern:response-shaper and pattern:tool.
Constrained parameters lack enums. 'staff_role' accepts 5 specific values but is defined as free-form string. 'transfer_window' accepts 3 values ('summer', 'winter', 'all') but no enum constraint. 'debut_type' accepts 2 values ('league', 'pro') but no enum. LLMs will hallucinate invalid values.
No error handling guidance. execute_r_function() catches exceptions and returns raw tracebacks. LLMs receive 'type: error, message: <stack trace>' with no recovery path. No distinction between retryable (rate limit, timeout) and fatal (invalid country) errors.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 43 | 2026-07-28+ | v2 |
Get team URLs for a specific country and season from Transfermarkt.
R code injection vulnerability. Tools construct R code via string interpolation (e.g., f'country_name = "{country_name}"'). If country_name contains quotes or R syntax, injection is possible. No input sanitization visible.
No pagination support. Tools return lists (team URLs, player URLs, staff URLs) with no limit, offset, or cursor parameters. Large results will blow context window. No total count or next_cursor in responses.