settings — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited settings (Hook) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- mcp-name: io.github.Ninjabeam20/sportiq-mcp -->
MCP server that turns any AI assistant into a sports analyst across FIFA World Cup 2026 football, Formula 1, and IPL cricket — 46 AI-callable tools.
<a href="https://mcpbeat.com/mcp-servers/ninjabeam20/sportiq-mcp/"><img src="https://mcpbeat.com/badge/ninjabeam20/sportiq-mcp.svg?style=card&corners=round&metric=security&theme=light&w=auto" alt="SportIQ on MCPbeat — live status and code findings" width="300"></a>
SportIQ demo — Claude calling football_simulate_bracket for World Cup 2026 title probabilities
SportIQ running live in Claude — Monte Carlo World Cup bracket, F1 pit strategy, and Dream11 optimisation, each a visible MCP tool call. ([1-min demo](docs/assets/SportIQ.mp4))
<p align="center"> <a href="https://github.com/sponsors/Ninjabeam20"><img src="https://img.shields.io/badge/%E2%9D%A4_Sponsor_SportIQ-EA4AAA?style=for-the-badge&logo=githubsponsors&logoColor=white" alt="Sponsor SportIQ"></a> <a href="https://sport-iq-sports-analysis.vercel.app"><img src="https://img.shields.io/badge/%F0%9F%8C%90_Website-Visit-2563EB?style=for-the-badge" alt="Website"></a> </p>
Every tool is free to use — the three flagships and everything in the INTEL columns below have no SportIQ paywall or account requirement. Live/provider-backed data still depends on the keys and quota available to the host or local operator. If SportIQ is useful to you, sponsor the project to support ongoing development.
f1_simulate_championship: a title-race Monte Carlo with exact elimination maths.football_what_if: replays World Cup 2026 from any stage, optionally flipping one real knockout result./healthz liveness route.TOOL_DEADLINE_SECONDS) and a 15 s budget per data chain.uvx sportiq-mcp@latest picks up 0.4.0. The hosted connector URL stays the same.Raw-data tools are table stakes; the intelligence layer is the product. Three flagships:
| Sport | RAW data | INTEL |
|---|---|---|
| Football (WC 2026) | groups, fixtures, standings, squad, match stats, top scorers, odds | xg_model, match_predictor, simulate_group, simulate_bracket, knockout_path, form_trends, find_value_bets, build_accumulator, what_if |
| F1 | sessions, drivers, lap_times, standings, race_results, weather | tyre_degradation, undercut_window, head_to_head_pace, weather_strategy_impact, qualifying_analysis, race_pace_compare, predict_pit_strategy, simulate_championship |
| Cricket (IPL) | live_matches, scorecard, points_table, schedule, squad, live_odds | build_dream11_team, captain_recommendation, differential_picks, player_form_index, pitch_report, head_to_head, player_matchup, find_value_bets |
| Cross-sport | — | build_accumulator |
Plus sportiq_health (included in the 46; cache backend + per-adapter status and remaining API quota).
MCP resources (static JSON, readable without a tool call): sportiq://instructions, sportiq://football/wc2026/draw, sportiq://football/team-codes, sportiq://f1/circuits, sportiq://cricket/venues, sportiq://cricket/teams, sportiq://cricket/scoring-profile.
Data sources (per chain, with keyless fallbacks): football → API-Football → football-data.org → openfootball (keyless) → bundled wc2026.json; standings fall back to a table derived from fixture results. F1 → OpenF1 → Jolpica → fastf1. Cricket → CricAPI → RapidAPI Cricbuzz (paid fallback) + static seeds (NDTV/Cricbuzz scrapers opt-in). Odds (football + cricket) → The Odds API.
Anywhere that speaks MCP — Claude (Desktop + web), ChatGPT, Cursor, and any MCP client. Two ways to run it:
A public instance runs on the home server behind Cloudflare. Add this as a custom connector with No authentication:
https://sportiq.utkarshgupta.org/mcpHosting history (GCP Cloud Run → home server): docs/wiki/findings/product-hosting-arc.md. Old *.run.app connector URLs are gone.
All 46 tools register on the plain URL. Whether a live/provider-backed call can return current data depends on the credentials, quota, and fallbacks available to the hosted operator; the repository does not claim the public instance's current key inventory.
| Mode | What is available |
|---|---|
| Hosted | All tools register; live/provider-backed results depend on the host's current keys, quota, and fallbacks. |
| Local, keyless | All tools register; bundled seeds and keyless sources work where supported, while credential-only live sources are skipped. |
| Local, BYO keys | The same tools can use the configured providers for fresher/live data, subject to provider quota. |
The hosted HTTP boundary rejects request bodies over 1 MiB, limits traffic to 60 requests per client and 300 total requests per minute, and permits at most two concurrent expensive model/solver calls. These counters are per process, so the home-server Compose stack runs one replica (always-on idle; no scale-to-zero).
uvx sportiq-mcp # from PyPI
# or from source:
git clone https://github.com/Ninjabeam20/SportIQ-MCP && cd SportIQ-MCP
uv sync --extra dev && uv run python -m sportiq.server # --extra dev = pytest/ruff for contributorsClaude Desktop config:
{
"mcpServers": {
"sportiq": {
"command": "uvx",
"args": ["sportiq-mcp"],
"env": {
"CRICAPI_KEY": "your_cricapi_key",
"APIFOOTBALL_KEY": "your_apifootball_key",
"THEODDS_KEY": "your_theodds_key"
}
}
}
}The server boots and registers every tool without keys. Seed/keyless fallbacks and the intelligence layer work where their required inputs are available; provider keys add fresher/live sources and quota rather than unlocking a separate paid tool tier.
| Var | Unlocks | Free tier |
|---|---|---|
APIFOOTBALL_KEY | Live football fixtures / standings / squads / scorers | 100 req/day |
THEODDS_KEY | Market odds (football + cricket probability tools) | 500 req/month |
FOOTBALLDATA_KEY | football-data.org fallback — required for World Cup endpoints (they return 403 without it) | 10 req/min, 100/day |
CRICAPI_KEY | Live cricket scores / scorecards / schedules / squads | 100 req/day |
RAPIDAPI_KEY | Paid Cricbuzz fallback (player career stats) | plan-dependent |
SPORTIQ_ENABLE_NDTV / SPORTIQ_ENABLE_CRICBUZZ | Opt-in cricket scrapers (off by default — ToS) | — |
REDIS_URL | Shared cache backend (defaults to local diskcache) | — |
SPORTIQ_TRANSPORT | stdio (default, local) or http (remote / home server) | — |
TOOL_DEADLINE_SECONDS | Per-tool deadline (default 30); a slower call returns UPSTREAM_TIMEOUT | — |
macOS arm64: the Dream11 solver needs CBC — brew install cbc (the binary bundled with PuLP is x86-only).Set SPORTIQ_TRANSPORT=http and the server serves the MCP endpoint at /mcp (binds 0.0.0.0:$PORT). GET /healthz returns 200 ok for liveness only (it never touches the cache, chains or network). A ready-to-build Dockerfile and home-server docker-compose.yml are included. cloud.md is the old Cloud Run runbook (historical). With your own keys set, the live-score and odds tools come online too.
Every tool is free and open source — the raw-data tools, sportiq_health, and the full intelligence layer (the three flagships + everything in the INTEL columns). SportIQ has no paid feature gate; provider-backed data can still require operator credentials and quota.
If SportIQ saves you time, [sponsor the project at github.com/sponsors/Ninjabeam20](https://github.com/sponsors/Ninjabeam20) to help fund hosting and ongoing development. It's a voluntary donation — you get the same fully-unlocked server either way.
tool_call / mcp_request lines to a local JSONL volume. Local stdio emits local logs but sends no telemetry to a SportIQ-hosted service.TOOL_DEADLINE_SECONDS) and each fallback chain a 15 s total budget.SECURITY.md; they are not a current third-party certification.Every response carries a meta.is_stale flag + data age, so the AI tells you how fresh each answer is. Cricket live scores refresh ~30s, F1 completed-session laps/stints ~24h, standings ~10min, football fixtures ~6h (the WC 2026 is over).
uv sync --extra dev --extra analytics # always both extras: dev = pytest/ruff, analytics = the dashboard's GCP libs
uv run pytest
uv run ruff check .
npx @modelcontextprotocol/inspector uv run python -m sportiq.serverAnalytics dashboard (read-only local usage view — Dell JSONL / archived GCP / PyPI / GitHub). Same setup as above, then just run it:
uv run python scripts/dashboard.py # writes dashboard.html and opens it; GITHUB_TOKEN optional (Sponsors panel)Note: the dashboard's HTML template (scripts/dashboard_template.html) is currently local-only maintainer tooling, so a fresh clone can't render it yet.Repository layout: src/ is the MCP server (published to PyPI, hosted on the Dell at https://sportiq.utkarshgupta.org/mcp); website/ is the Next.js marketing site deployed to Vercel. The two ship independently — website/ is excluded from the Python package and the backend container.
See CLAUDE.md for collaboration rules and docs/index.md for the wiki entry point.
SportIQ derives some model constants offline from open datasets. Raw datasets are never shipped or fetched at runtime — only small derived seeds (circuits.json, venues.json, elo_seed.json) are committed.
venues.json).Created and maintained by Utkarsh Gupta (@Ninjabeam20). Licensed under the MIT License — © 2026 Utkarsh Gupta. Canonical package: sportiq-mcp on PyPI / io.github.Ninjabeam20/sportiq-mcp in the official MCP registry.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.