Jvlink MCP Server is an MCP server that JRA racing analysis MCP server for JVLinkToSQLite databases. Its tool list has not been published yet over stdio and http, requires no API key, and scores 82/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients — only the file and path differ.
{
"mcpServers": {
"jvlink": {
"env": {
"DB_PATH": "/path/to/keiba.db",
"DB_TYPE": "sqlite"
},
"args": [
"run",
"--directory",
"/path/to/jvlink-mcp-server",
"python",
"-m",
"jvlink_mcp_server.server"
],
"command": "uv"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
SQLを書く必要はありません。自然な日本語で質問すれば、過去のレース結果、騎手成績、血統傾向など、あらゆる競馬データを調べられます。
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
uvx 'uv' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories — click any category to see the underlying evidence.
uv allows ZIP payload obfuscation through parsing differentials
## Impact In versions 0.8.5 and earlier of uv, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. This enabled two parser differentials against other Python package installers: 1. An attacker could contrive a ZIP archive that would extract with legitimate contents on some package installers, and malicious contents on others due to multiple local file entries. The attacker could choose which installer to target
uv is vulnerable to arbitrary file write through entry point names
### Impact In versions of uv prior to 0.11.15, when installing a distribution containing an entry point specification (under `console_scripts` or `gui_scripts`), uv would place the generated entry point according to the given name even if doing so resulted in a path outside of the environment's scripts directory. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's `PATH`. This could shadow or overwr
uv vulnerable to arbitrary file deletion through RECORD entries
## Impact Wheel RECORD entries can contain relative paths that traverse outside of the wheel’s installation prefix. In versions 0.11.5 and earlier of uv, these wheels were not rejected on installation and the RECORD was respected without validation on uninstall. uv uses the RECORD to determine files to remove on uninstall. Consequently, a malicious or malformed wheel could induce deletion of arbitrary files outside of the wheel’s installation prefix on uninstall. uv does not use the RECORD fi
PYSEC-2026-2295
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
uv has differential in tar extraction with PAX headers
### Impact In versions 0.9.4 and earlier of uv, tar archives containing PAX headers with file size overrides were not handled properly. As a result, an attacker could contrive a source distribution (as a tar archive) that would extract differently when installed via uv versus other Python package installers. The underlying parsing differential here originates with astral-tokio-tar, which disclosed this vulnerability as CVE-2025-62518. In practice, the impact of this vulnerability is **low**:
Click any tool to inspect its schema.
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Others in analytics
MCP Server for GCP environment for interacting with various Observability APIs.
Deterministic, persistent graph server for tracking workflow state, decisions, and blockers.
MCP server for RocketCyber Managed SOC — incidents, alerts, agents, and customer telemetry.
Trending hip-hop artist momentum scores across four cultural dimensions.
MCP Security Weekly
Get CVE alerts and security updates for Jvlink Mcp Server and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
Claudeに話しかけるだけで、競馬データを自由に分析できます。
SQLを書く必要はありません。自然な日本語で質問すれば、過去のレース結果、騎手成績、血統傾向など、あらゆる競馬データを調べられます。
| 出走数 | 勝利数 | 勝率 |
|---|---|---|
| 6,294 | 2,474 | 39.3% |
| 騎手 | 騎乗数 | 勝利 | 勝率 |
|---|---|---|---|
| ルメール | 537 | 142 | 26.4% |
| 戸崎圭太 | 832 | 135 | 16.2% |
| 松山弘平 | 863 | 125 | 14.5% |
| 坂井瑠星 | 729 | 119 | 16.3% |
| 川田将雅 | 542 | 118 | 21.8% |
| 種牡馬 | 出走数 | 勝利 |
|---|---|---|
| キズナ | 1,717 | 207 |
| ロードカナロア | 1,633 | 178 |
| ドレフォン | 1,382 | 150 |
| エピファネイア | 1,488 | 138 |
| リアルスティール | 1,106 | 125 |
対話式インストーラーで、クローン → 依存解決 → DB検索 → クライアント設定まで一発で完了します。
macOS / Linux:
curl -fsSL https://raw.githubusercontent.com/miyamamoto/jvlink-mcp-server/master/install.sh | bash
Windows (PowerShell):
irm https://raw.githubusercontent.com/miyamamoto/jvlink-mcp-server/master/install.ps1 | iex
💡 keiba.db が見つからない場合、JRA-VAN DataLabの契約ページをブラウザで自動的に開きます。jrvltsqlの同時インストールも選べます。
jrvltsql を使ってJRA-VANからデータを取得し、keiba.dbを作成します。
JRA-VAN DataLab の契約が必要です → https://jra-van.jp/dlb/
地方競馬データも必要な場合は 地方競馬DATA → https://www.keiba-data.com/
git clone https://github.com/miyamamoto/jvlink-mcp-server.git
cd jvlink-mcp-server
pip install uv
uv sync
お使いのクライアントに合わせて以下のセクションを参照してください。
💡 初回起動時に依存パッケージを自動インストールします(30〜60秒)。
claude_desktop_config.json に追加:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json{
"mcpServers": {
"jvlink": {
"command": "uv",
"args": ["run", "--directory", "/path/to/jvlink-mcp-server", "python", "-m", "jvlink_mcp_server.server"],
"env": {
"DB_TYPE": "sqlite",
"DB_PATH": "/path/to/keiba.db"
}
}
}
}
Windows の場合:
commandを"uv.exe"に変更してください。Releases の.mcpbファイルを使えば自動インストールも可能です。
claude mcp add jvlink \
-e DB_TYPE=sqlite \
-e DB_PATH=/path/to/keiba.db \
-- uv run --directory /path/to/jvlink-mcp-server python -m jvlink_mcp_server.server
プロジェクトスコープに追加する場合は -s project を付けてください。
プロジェクトルートに .cursor/mcp.json を作成:
{
"mcpServers": {
"jvlink": {
"command": "uv",
"args": ["run", "--directory", "/path/to/jvlink-mcp-server", "python", "-m", "jvlink_mcp_server.server"],
"env": {
"DB_TYPE": "sqlite",
"DB_PATH": "/path/to/keiba.db"
}
}
}
}
Cursor Settings → MCP でサーバーが認識されていることを確認してください。
.vscode/mcp.json を作成:
{
"servers": {
"jvlink": {
"command": "uv",
"args": ["run", "--directory", "/path/to/jvlink-mcp-server", "python", "-m", "jvlink_mcp_server.server"],
"env": {
"DB_TYPE": "sqlite",
"DB_PATH": "/path/to/keiba.db"
}
}
}
}
VS Codeの設定で "chat.mcp.enabled": true を有効にしてください。
Windsurf Settings → MCP から「Add custom server」を選択し、~/.codeium/windsurf/mcp_config.json に追加:
{
"mcpServers": {
"jvlink": {
"command": "uv",
"args": ["run", "--directory", "/path/to/jvlink-mcp-server", "python", "-m", "jvlink_mcp_server.server"],
"env": {
"DB_TYPE": "sqlite",
"DB_PATH": "/path/to/keiba.db"
}
}
}
}
# codex の設定ファイル (~/.codex/config.
... [View full README on GitHub](https://github.com/miyamamoto/jvlink-mcp-server#readme)