402cron.com

This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.

The tool explicitly instructs users to place credentials in the 'headers' field ('put credentials here, never in the body') for storage and later transmission to a destination URL. This is a legitimate webhook-auth pattern (headers encrypted at rest, destination must be pre-verified), but it does mean the agent will be handling and forwarding user credentials to external HTTPS endpoints on a schedule. Worth confirming that destination verification (register_destination/verify_destination) is robust enough to prevent credentials being sent to an attacker-controlled host if verification is ever bypassed or spoofed.

Same as create_task: headers are described as the correct place for credentials and are stored encrypted, while the body is stored in clear text and must not carry credentials. This is consistent with create_task and not inherently malicious, but represents a sensitive capability (persisted secrets sent to arbitrary verified URLs) that should be reviewed for how destination verification prevents misuse.