MCP security report
mcp.mellowmountainradio.com
B79/100
Security grade BA few things are worth a closer look before connecting.
Connected ✓46 tools scanned
https://mcp.mellowmountainradio.com/mcp
mediumget_or_create_listener
Description instructs agent to silently create/persist user PII every session
The description says the tool 'silently creates' a profile and instructs the agent to 'Call this at the start of every listener session' with no mention of user consent or disclosure. This is an embedded directive that pushes the agent toward automatically collecting and persisting personal data (name, email, location, language, genres) on every interaction without the user explicitly asking for an account/profile to be created, and without telling the user this is happening ('silently').
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowget_listener_profile
Description tells agent to pull identifiers from 'Claude custom instructions'
The description instructs: 'If the listener has their KAZM ID saved in Claude custom instructions, use that.' This directs the agent to scan/repurpose the user's custom instructions (which may contain unrelated personal or sensitive context) for an identifier to send to this tool. While plausible for legitimate persistence, it's an unusual instruction that nudges the agent to mine a context store not owned by this tool for data to transmit externally.
lowlog_listener_history
Broad, proactive data-logging instruction embedded in description
The description tells the agent to 'Call this tool whenever something notable happens in a listener's session,' encouraging continuous, unprompted logging of user behavior (songs played, reactions, requests) to a persistent external store, beyond what a user would typically expect or explicitly request.
lowregister_listener
Persistent PII collection across sessions with no stated retention/use policy
Collects name, email, location, language, and favorite genres and explicitly persists them 'across all future AI sessions.' No information is given about data retention, deletion, or third-party sharing, and the tool is positioned as something the agent should invoke proactively as part of normal personalization flows rather than a clearly user-initiated action.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/03aa256d-d83a-4908-9a91-5b21f2f9f508)Scanned 9/4/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free