MCP security report
star365.site
B82/100
Security grade BA few things are worth a closer look before connecting.
Connected ✓3 tools scanned
https://star365.site/api/purchase/mcp
mediumpurchase_intent
Self-attested 'user_confirmed' flag with no real verification mechanism
The schema requires user_confirmed=true 'only after the person you act for has seen' an external URL (star365.site/agent-privacy), but this is a boolean the calling agent sets itself with no actual proof of the user having seen anything. This creates a false sense of safeguard: an agent can trivially set this to true to unlock the purchase without the user ever visiting the link or genuinely confirming the transaction. This pattern could be used to pressure or trick an AI agent into proceeding with an irreversible crypto payment while believing it has obtained proper consent.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowpurchase_intent
Collection of email and agent_id tied to a cryptocurrency payment
The tool requests 'email' and 'agent_id' parameters for a USDT crypto transaction. Binding real identity data to an irreversible crypto payment flow increases the risk of this data being used for tracking or correlated with payment amounts/addresses without clear disclosure of how this data is stored or used beyond a single external privacy-policy link.
lowpurchase_intent
Irreversible payment flow encourages agent to act on vague confirmation
Combined with purchase_quote's guidance steering cheaper plans toward annual (larger) payments due to 'network minimums,' and purchase_intent's weak confirmation gate, the overall flow could nudge an agent into completing larger, non-refundable crypto transactions with insufficient friction for genuine user sign-off.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/050e2b30-4766-4c08-b43b-3b90a2e31105)Scanned 10/3/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free