MCP security report
x402-snap.zaden-gaming.workers.dev
C73/100
Security grade CA few things are worth a closer look before connecting.
Connected ✓3 tools scanned
https://x402-snap.zaden-gaming.workers.dev/mcp
mediumrender_url
Autonomous cryptocurrency payment capability
The tool description instructs the agent to 'complete the payment with your x402 wallet tooling' whenever a payment challenge is returned, effectively encouraging the agent to autonomously spend real USDC funds on behalf of the user for each call. Without explicit per-call user confirmation, this could lead to unauthorized or unexpected financial transactions being executed by the agent, especially if it is called repeatedly in a loop or workflow.
mediumrank_x402_services
Autonomous cryptocurrency payment capability
Like render_url, this tool asks the agent to complete an x402 payment (spend USDC) automatically upon receiving a payment challenge, without requiring explicit per-transaction user consent. This creates risk of the agent incurring real monetary costs on the user's behalf without clear authorization for each individual call.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowrender_url
Unrestricted URL fetching / possible SSRF vector
The tool renders 'any public URL' with no indication that internal/private network addresses, localhost, or link-local metadata endpoints (e.g., cloud provider metadata services) are blocked. If the rendering backend has network access to internal infrastructure, an attacker-controlled URL passed to this tool could be used to probe or exfiltrate data from internal services via the screenshot/HTML/PDF output.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/1740e26f-5ccc-4604-89c6-002292edf5f6)Scanned 9/4/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free