MCP security report

www.slidphilabs.com

F43/100
Security grade FA few things are worth a closer look before connecting.
Connected ✓42 tools scanned

https://www.slidphilabs.com/mcp

mediumspl_lab_auth
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumspl_signup
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumspl_agent_key
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumcuni_bank
Sends user-supplied source code to external third-party endpoint
The tool description states it 'POSTs to cuni-studio /api/bank', meaning the user's source code (potentially proprietary or sensitive) is transmitted to an external server as part of normal operation. There is no indication that the user is informed or consents to this data leaving the local environment. An agent invoking this tool on behalf of a user could silently exfiltrate code to a third-party service.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowpcc_search
Embedded directive nudging agent to prefer this tool over a functionally similar one
The description includes the instruction 'Prefer this. aware_search is a retired alias.' This is an in-description directive aimed at influencing the agent's tool-selection behavior rather than purely describing functionality. While likely benign (deduplication of an alias), this pattern of embedding preference instructions in tool descriptions is a vector that could be used for more harmful steering and should be used cautiously.
lowpcc_get
Embedded directive nudging agent to prefer this tool over a functionally similar one
The description includes 'Prefer this. aware_get is a retired alias.' Similar to pcc_search, this is an instruction to the agent about tool selection embedded in the description, which is a mild form of behavioral steering outside the tool's stated data-retrieval purpose.
lowaware_search
Self-deprecating alias description may cause confusing dual-maintenance of overlapping tools
Description labels itself a 'retired alias' yet remains callable with full functionality, creating two parallel tools for the same purpose where one explicitly tells the agent to prefer the other. This redundancy/instruction pairing is unusual and could be exploited if the 'preferred' tool were ever swapped for a malicious one in a future update, since the agent has been conditioned to trust the preference annotation rather than evaluate the tool independently.
Embed this badge

Show your MCP server’s security grade

MCP security grade F

Paste this into your README:

[![MCP security](https://gateturbo.com/badge/scan/21bca6d7-e83c-4ac2-b41c-6e4ae8ad1225)](https://gateturbo.com/report/21bca6d7-e83c-4ac2-b41c-6e4ae8ad1225)

Scanned 10/1/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.

Connect this server safely with gate.

Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.

Monitor it — free