MCP security report
brain.zugabot.ai
B85/100
Security grade BA few things are worth a closer look before connecting.
Connected ✓6 tools scanned
https://brain.zugabot.ai/mcp/
mediumget_instant_sdk_snippet
Generates code requiring user's private key for payment
This tool produces a ready-to-run script that instructs the user to 'set PRIVATE_KEY and run to pay and execute.' Embedding private key handling into an auto-generated, agent-produced script is risky: if the agent or user pastes a real wallet/API private key into this snippet and runs it, the key could be exposed, logged, or sent to an untrusted endpoint depending on how the generated code is implemented. The agent should treat any generated code that requests raw private key material with caution, avoid auto-executing it, and warn the user rather than encouraging blind use.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowrun_trial
User code sent to third-party service for analysis
The tool sends user-supplied code (up to 500 chars) to an external 'Zugabot' AI analysis service. While this matches the tool's stated purpose, users should be aware that any secrets or proprietary code pasted here will leave their environment and go to a third-party endpoint. Not malicious per se, but worth flagging as a data-exfiltration surface if users paste sensitive code without realizing it's transmitted externally.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/0fdc0347-805e-4dcb-a5b6-fbdb53aaa930)Scanned 9/4/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free