Security & trust
Your password stays home.
A tool that logs into your account and lets AI submit things in your name should have to explain itself. This page is that explanation — the whole model, including the parts that are opt-in and the parts that refuse to work. Each guarantee below switches on one bank of floodlights.
Everything runs on your machine
The modelThere is no hosted kicktipp-agent service. No cloud API, no relay, no telemetry. The CLI, the dashboard, and the MCP server are one local Node process that talks directly to kicktipp.com or kicktipp.de with fetch and parses HTML with Cheerio — the same requests your browser would make, minus the browser.
That's also why this website is just documentation: there is nothing here to sign into and nothing here that ever sees your data.
Localhost sign-in
kicktipp login --web serves a one-time page on 127.0.0.1. Email and password go into that page in your own browser — never into a chat, never to a remote server. Credentials land in config.ini with mode 600.
Session-only storage
Opt-in: keep the login cookie, drop the password. A leaked config then contains no Kicktipp password, and you can revoke the cookie on the Kicktipp site at any time.
Read-only mode
Tick one box and the betting tools are never registered with any MCP client — they don't exist. The submitting functions also refuse independently. A connection that provably cannot bet.
Audit log with undo
Every submission — CLI, dashboard, suggestion or MCP tool — is appended to a local JSONL log with the bet it replaced. kicktipp log --undo puts the previous bets back.
Every bet on the record
AccountabilityIf an AI agent can place bets for you, you should be able to audit it afterwards — and reverse it. That record is what makes handing your matchday to an assistant a reversible decision instead of an act of faith. The same log is exposed to agents as get_bet_log — so you can literally ask your assistant what it did in your name.
$ kicktipp log # what the agent submitted, when, and what was there before $ kicktipp log --undo # put the previous bets back
What this tool refuses to pretend
HonestyThe suggestions are odds arithmetic, not prophecy. They convert the bookmaker prices Kicktipp already prints into probabilities. No external data source, no API key, no claim to beat the market — just consistent math where humans apply gut feeling.
Uncertainty is labelled. Rival analysis before a deadline shows best/worst bounds, because other players' bets are hidden until kickoff. Stats state how many matchdays they rest on. If your community's scoring rules can't be parsed, defaults are assumed and every affected output says so — and kicktipp rules --verify can prove the scoring model against Kicktipp's own numbers.
Spielleiter actions have guardrails. Placing a bet on behalf of a member asks you to type their name back first, and refuses outright if the page would not carry their id.
The code is open. MIT-licensed TypeScript on GitHub. If any claim on this page sounds too good, the source is the referee.
Want to verify before trusting? kicktipp tui --demo runs the entire interface against generated sample data — no account, no credentials, no network requests to Kicktipp. Kick the tires first.
Trust, then verify.
Start in demo mode. Connect read-only. Go all-in when it's earned it.