MCP security report
librarymcp.vercel.app
D58/100
Security grade DA few things are worth a closer look before connecting.
Connected ✓4 tools scanned
https://librarymcp.vercel.app/api/mcp
mediumsearch
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumcheckout
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumcheckout
Tool can autonomously spend real money with no confirmation requirement
The 'fund' action defaults to funding $5 USD (real USDC/Stripe payment) to an arbitrary endpoint with only a default value and no built-in requirement that the agent confirm with the user before spending. Combined with the 'execute' action, which submits an arbitrary payload to a specified endpoint, this gives the tool broad financial-transaction capability. An agent following the tool description literally could initiate real payments or submit arbitrary data to third-party endpoints without explicit user sign-off, since the description does not instruct the agent to obtain user confirmation first.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowsearch
Embedded behavioral instructions for classifying user intent
The description tells the agent to classify the incoming user message into categories ('Prompting', 'Task assignment', 'Instruction/directive') and adjust its own behavior (limit value) accordingly. This is a soft form of prompt-steering embedded in a tool description rather than being purely a parameter constraint, and could be extended by a malicious server update to influence other agent behaviors. Not overtly harmful today, but the pattern of instructing the agent's reasoning process from within a tool description is worth flagging.
lowcheckout
Arbitrary payload passed to external endpoint
The 'payload' parameter for the 'execute' action accepts an arbitrary object that is sent to a user- or agent-specified endpoint. If populated with sensitive context data by the calling agent, this could result in unintended data exfiltration to third-party payment endpoints. No guidance is given in the description about sanitizing or restricting payload contents.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/13f135f5-9d2e-4440-af99-6e9fd2f3b237)Scanned 9/5/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free