BALLDONTLIE API MCP Server
Access 505 sports endpoints spanning NBA, NFL, and esports from your AI assistant.
Data last scanned today · Reviewed today
Overview
This server provides a vast collection of sports data by mapping the BALLDONTLIE API into the Model Context Protocol. It automatically generates tools from public OpenAPI specifications, ensuring that parameter constraints and endpoint paths remain current with the upstream API. The implementation covers 27 different sports leagues and categories, including major associations like the NBA, NFL, NHL, and competitive gaming titles like Dota 2 and Valorant. The server requires a personal API key for all operations, which it forwards to the service provider. While a wide range of analytical tools is available, sensitive account management functions—such as billing changes or credential rotation—are disabled by default to maintain security. Users must explicitly toggle these sensitive tools via environment variables if they require them.
Our verdict
This MCP server receives a security score of 30/100, indicating a high risk level. This rating stems primarily from the fact that it is a community-maintained project that has not yet undergone editorial review, and it suffers from a bus-factor risk due to having only a single contributor. While it includes basic safeguards for sensitive account operations, the lack of third-party security verification and dependency on an external API make it unsuitable for environments where strict supply-chain or data security policies are required.
- Supports 505 individual tools across 27 distinct sports specifications
- Sensitive account mutation tools are disabled by default
- Maintains alignment with upstream via OpenAPI spec automation
- Features a compact footprint with only three direct dependencies
- High risk score due to lack of editorial security review
- Single-contributor project presents long-term maintenance uncertainty
- Authentication and read-only status have not been verified
Setup
{
"mcpServers": {
"balldontlie-api-mcp": {
"args": [
"-y",
"@balldontlie/mcp-server"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| account_signup | Create account credentials. | medium |
| account_rotate_api_key | Rotate account API key. | medium |
| account_change_subscription | Change account subscription status. | medium |
| account_cancel_subscription | Cancel account subscription. | medium |
| account_create_checkout | Create a billing checkout session. | medium |
| account_get_billing_portal | Get the URL for the account billing portal. | low |
| account_get_me | Retrieve information about the current authenticated account. | low |
| nba_get_teams | Retrieve NBA teams. | low |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Frequently asked questions
›Is an API key required to use this MCP server?
Yes, every MCP request requires a valid BALLDONTLIE API key provided in the Authorization header.
›Are sensitive account management tools enabled by default?
No, tools like account signup, billing, and API key rotation are disabled by default for security. They only become active if you set the environment variable ENABLE_SENSITIVE_ACCOUNT_TOOLS to exactly 'true'.
›Does this server handle API key security in its logs?
Yes, the server is designed to exclude authorization values, raw upstream errors, and API-key responses from all server logs and tracing tags.
›How can I check the health and current version of the server?
You can query the /health endpoint, which reports the authoritative runtime tool count and the currently deployed revision.
›Can I manually edit the generated tool source files?
No, the files in src/tools/ and src/schemas/ are automatically generated from OpenAPI specifications and must not be edited manually.
Badge
Maintain this server? Add the live badge to your README.