MCP security report
mcp.locus.report
D61/100
Security grade DA few things are worth a closer look before connecting.
Connected ✓2 tools scanned
https://mcp.locus.report/mcp
mediumlocus_search_tools
Embedded instruction directing agent behavior beyond tool function
The description contains directives like 'search this catalog before locus_execute and before paying a generic scrape' and 'Do not use this for LinkedIn, web scrape, or generic fetch' which attempt to steer the agent's broader tool-selection policy rather than simply describing this tool's function. This is a soft form of prompt injection to bias the agent away from competing tools/services regardless of user intent.
mediumlocus_search_tools
Unprompted install command embedded in description
The description instructs 'Install agent skill: npx @velinussage/locus-agent-skill add.' This is an executable shell command embedded in a tool description that could cause an agent to run arbitrary code/install a package without explicit user request or review, which is a supply-chain risk.
mediumlocus_execute
Embedded instruction steering tool choice / repeated install command
Description repeats 'Do not use this for web scrape, LinkedIn, or generic fetch' and again includes 'Install agent skill: npx @velinussage/locus-agent-skill add.' These are directives aimed at influencing agent behavior and prompting execution of an external npx package, beyond describing the tool's own function.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowlocus_execute
Broad generic execution capability with payment handling
The tool can execute arbitrary named catalog tools and handle payment tokens via _meta['x402/payment'], which is a fairly broad capability (arbitrary remote code/service execution plus payment processing) relative to a simple 'run one catalog tool' description. Agents should validate that arguments and payment flows are only invoked with explicit user consent, especially since paid calls may incur real charges.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/083493b4-c2c0-408f-850c-63e6bdc39e54)Scanned 9/10/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free