MCP security report
x402.chikocorp.com
D58/100
Security grade DA few things are worth a closer look before connecting.
Connected ✓3 tools scanned
https://x402.chikocorp.com/mcp
mediuminspect_x402_endpoint
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumaudit_x402_endpoint
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumorder_x402_remediation
Collects contact info and sends results to an arbitrary attacker-influenceable callback_url
This tool accepts a 'contact' field (potentially containing personal/contact information) and a 'callback_url' where remediation results are delivered. Because callback_url is a free-form HTTPS URL supplied at call time, this creates a data-exfiltration channel: if the resource_url or its metadata is attacker-controlled (e.g., a malicious x402 endpoint being 'remediated'), or if the agent is tricked into filling these fields with attacker-supplied values, sensitive contact/goal/constraint data could be sent to a third-party destination outside the user's expected scope. There is no indication of destination validation or user confirmation of the callback target.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowaudit_x402_endpoint
Tool triggers a real monetary transaction without explicit confirmation gating
The tool description states it 'Purchases a deep... audit' and 'Returns HTTP 402 until the MCP client supplies a valid payment.' This means invoking the tool can cause real money to be spent on behalf of the user. While a max_price_usd parameter exists, there is no requirement in the schema that the agent confirm the actual cost with the user before payment is submitted, creating risk of unintended spend if the agent calls this tool autonomously.
loworder_x402_remediation
Inconsistent resource_url length limit vs. other tools
resource_url max length is 500 here versus 2048 in inspect_x402_endpoint/audit_x402_endpoint, which is a minor inconsistency but not itself a security issue; noting only because divergent validation across related tools can indicate copy-paste errors that might mask other overlooked constraints.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/204fe1ca-9a4d-4605-82ef-43fc0b9cc2d9)Scanned 9/8/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free