FutPicks MCP Server

Model Context Protocol server for football data: probable lineups with a per-player start probability and expected fantasy points, match analysis, model picks and a public track record — LaLiga, Premier League, Serie A, Bundesliga, Ligue 1 and Primeira Liga.

Every tool calls the public futpicks.com REST API over HTTPS. No database access, no shell, no local secrets beyond the API tokens you put in the environment. The lineup, match and track-record tools need no key at all.

The lineups are graded in public against the confirmed XI, so the accuracy the tools report is measured, not claimed. Same data as futpicks.com/onces/la-liga.

Quick start

Add it to any MCP client (Claude Code shown here) — no install step, npx fetches it:

{
  "mcpServers": {
    "futpicks": {
      "command": "npx",
      "args": ["-y", "futpicks-mcp"]
    }
  }
}

Then ask for a probable lineup: flab_teams to find a club, flab_matches_upcoming for the fixtures, flab_match_details for the projected XI and the model's read of the match.

To unlock the Pro and admin tools, add the keys:

{
  "mcpServers": {
    "futpicks": {
      "command": "npx",
      "args": ["-y", "futpicks-mcp"],
      "env": {
        "FUTPICKS_API_KEY": "flab_live_…"
      }
    }
  }
}

Building from source

git clone https://github.com/Khavel/futpicks-mcp.git
cd futpicks-mcp
npm install
npm run build      # compiles src/index.ts → dist/index.js

For local development with hot reload: npm run dev.

Environment variables

Public tools work with no token at all.

Where to get the tokens

Mint API keys from the web app: futpicks.com → Account → API Keys (Cuenta → Claves de API).

• FUTPICKS_API_KEY — create a Data-scope key. It looks like flab_live_… and satisfies the Pro-tier (ProTier) endpoints. Pro and admin users can mint these.
• FUTPICKS_OPS_TOKEN — create an Ops-scope key. It looks like flab_ops_… and satisfies the admin (Ops) endpoints. Only admins can mint these.

The raw key is shown once at creation, so copy it into your environment immediately. Keys are stored only as SHA-256 hashes, support optional expiry, and can be revoked from the same screen; revoked or expired keys are rejected with 401.

Tools

Public (no auth)

Data tools (require FUTPICKS_API_KEY)

Ops tools (require FUTPICKS_OPS_TOKEN, admin-only)

flab_ops_run kinds: ingestion-runs, scoring-runs, settlement-runs, calibration-runs, intelligence-refreshes. The server auto-generates an Idempotency-Key per ops POST.

Claude Desktop configuration

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "footballlab": {
      "command": "node",
      "args": ["C:/Users/ceja_/Desktop/Desarrollos/Furbov2/mcp-server/dist/index.js"],
      "env": {
        "FUTPICKS_API_URL": "https://futpicks.com",
        "FUTPICKS_API_KEY": "your-pro-tier-token",
        "FUTPICKS_OPS_TOKEN": "your-admin-token"
      }
    }
  }
}

Verify locally

npx @modelcontextprotocol/inspector node dist/index.js

Then call flab_health (no token needed) — it should return live system status.

Security

• No tool reads DB connection strings, appsettings secrets, or shells into the VPS.
• All inputs are validated with zod; page sizes and ranges are capped server-side.
• Tokens are read from environment variables only and never logged.
• Data/ops tools fail with a clear message when their token is missing — they never fall back to an unauthenticated call.
• Ops mutations send a fresh Idempotency-Key so retries are deduplicated by the API.