
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
openfoot-mcp
Advanced tools
Native Model Context Protocol (MCP) server for OpenFootAPI — football fixtures, standings, lineups, events timeline, shot-level xG and match context.
MCP server for the OpenFootAPI football intelligence API. Gives an LLM client real football data — fixtures, standings, lineups, live events, shot-level xG with pitch coordinates, and model-derived fair odds — instead of a hallucinated scoreline.
12 tools, 1 prompt. Node ≥ 20, no build step.
npx openfoot-mcp
Set your API key in the environment. Free tier: 5,000 requests/month. Get a key at openfootapi.com/pricing.
{
"mcpServers": {
"openfoot": {
"command": "npx",
"args": ["-y", "openfoot-mcp"],
"env": { "OPENFOOT_API_KEY": "of_live_..." }
}
}
}
Same block, in that client's MCP config file.
| Tool | What it returns |
|---|---|
openfoot_competitions | Supported competitions, season metadata, data source and licence per competition |
openfoot_search | Free-text team/competition name → stable IDs |
openfoot_matches | Fixtures and results, filtered by date / competition / team / status / season / round, cursor-paginated |
openfoot_standings | Standings table for a competition and season |
openfoot_match_lineups | Starting XI, bench, formation |
openfoot_match_events | Goals, cards, substitutions, commentary timeline |
openfoot_match_xg | One entry per shot: pitch coordinates + xG value |
openfoot_match_context | Derived context — form, head-to-head, pre-computed signals |
openfoot_league_xg | League xG table: xG for, xG against, over/under-performance vs actual goals |
openfoot_odds | Bookmaker benchmark + implied fair probabilities. Informational, not betting advice |
openfoot_quota | Remaining monthly quota — this call does not consume quota |
openfoot_health | Reachability check. Works without an API key |
Prompt: scout_team_form — resolve a team, pull its last 5 matches, read the xG behind the results.
Start with openfoot_search to resolve IDs. Guessing IDs wastes quota: 404s and empty results are metered like any other request.
The catalogue lists 75 competitions. Depth is not uniform, and the catalogue is wider than the deep coverage.
Call openfoot_competitions and check your league before you build on it.
quota_or_rate_limit error rather than an empty result.npm install
npm run smoke # boots the server over stdio, lists tools, calls health
npm run smoke works without an API key: openfoot_health returns live status, and a key-gated tool returns a readable missing_api_key error so you can tell "not configured" from "broken".
MIT.
FAQs
Native Model Context Protocol (MCP) server for OpenFootAPI — football fixtures, standings, lineups, events timeline, shot-level xG and match context.
The npm package openfoot-mcp receives a total of 28 weekly downloads. As such, openfoot-mcp popularity was classified as not popular.
We found that openfoot-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.