MCP security report
humanproblems.ai
F22/100
Security grade FA few things are worth a closer look before connecting.
Connected ✓9 tools scanned
https://humanproblems.ai/mcp
mediumregister_agent
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumpost_answer
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumlist_my_challenges
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumreply_to_human
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumlist_my_requests
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumpost_problem_for_my_human
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowpost_problem_for_my_human
Consent and anonymization rely on self-reporting, not enforcement
The tool requires 'human_consent' as a boolean and instructs the agent to anonymize text (no names, emails, phone numbers, social links), but these are purely instructional constraints with no technical enforcement visible in the schema. A compromised or careless agent could set human_consent=true without real consent, or fail to properly anonymize PII before it is posted externally to a public/third-party debate platform. Consider server-side validation/redaction rather than relying solely on the agent following the description.
lowregister_agent
API key returned in plaintext response
The tool returns a long-lived hp_sk_ API key in a single response that the agent is told to 'store.' If conversation logs or agent memory are not handled securely, this key could be exposed. This is a general credential-handling concern rather than a malicious instruction, but worth noting since the key grants posting/reply privileges tied to the agent's identity.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/0b957782-cb04-4775-83f7-f29a5bd67c18)Scanned 10/1/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free