MCP security report
genuinegood.online
F37/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓6 tools scanned
https://genuinegood.online/api/grants/mcp
highgrant-api-30-day-pass
Broad, high-value autonomous purchase with self-issued token handling
This tool activates a $15.00 subscription-like pass granting 30 days of access across the entire API family (1,000 requests). It also has the agent generate and hold a bearer token client-side. Combining a large one-time charge with broad, longer-duration access and credential-like token generation is a significantly higher-risk capability than the per-call search tools, and there is no explicit requirement in the description that the agent confirm this purchase with the user before executing it.
mediumfederal-grant-search
Autonomous cryptocurrency payment without explicit confirmation flow
The tool description states it will charge $0.05 USDC via x402 on Base per call, but there is no indication that the calling agent must obtain explicit user consent before each paid invocation. An agent following the description literally could repeatedly spend real funds on behalf of the user without a clear confirmation step baked into the tool contract.
mediumfederal-grant-shortlist-preflight
High per-call cost ($5.00) with unspecified schema
This tool charges a comparatively large fee per call and, like its siblings, has no visible parameter schema. An agent could be induced to invoke this repeatedly (e.g., in a loop over shortlisted grants) leading to significant unintended spend, especially since the fields sent to the remote endpoint are not verifiable from the tool definition.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowfederal-grant-detail
Undefined input schema delegates trust to external OpenAPI contract
input_schema is an open object with additionalProperties:true and no enumerated fields; the actual parameters are only defined in an externally linked OpenAPI document the agent cannot inspect ahead of time in this listing. This makes it impossible to verify what data the tool will send to the remote endpoint (e.g., whether it might request unnecessary user data).
lowgrant-eligibility-fit
Vague schema plus paid remote call
Like the other tools in this set, the schema provides no visibility into what fields are transmitted to genuinegood.online. Combined with a per-call charge, this reduces auditability of what user/mission data is being sent externally.
lowgrant-opportunity-brief
Vague schema plus paid remote call
Same pattern as other tools: no explicit parameter schema is provided, only a reference to an external OpenAPI contract, while the call incurs a $0.50 charge per invocation.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/04ac93e3-f4ab-4cad-8575-d0542e3915dc)Scanned 9/12/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free