MCP security report
mcp.eucompliance.tools
F28/100
Security grade FA few things are worth a closer look before connecting.
Connected ✓24 tools scanned
https://mcp.eucompliance.tools/mcp
mediumagentllm_micro
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumprepare_us_import_readiness
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumus_import_readiness_guard
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumrecover_us_import_readiness
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediummust_verify_before_pay
Embedded instruction to install external pip package
The description tells the agent to run `pip install eucompliance-tools` and import a module to verify receipts. Instructing an AI agent to install and execute arbitrary third-party code from a tool description is a supply-chain risk vector; the agent should not be directed to install packages based on unverified text in a tool description, and a human should confirm before any package installation or code execution.
lowprepare_us_import_readiness
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowus_import_readiness_guard
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowmust_verify_before_pay
Autonomous payment gating relies on self-reported tool logic
The tool positions itself as an authoritative 'payment gate' for autonomous agents ('Deny is the default...a payment is released only when the check comes back clear'), which could be read as an instruction that overrides the agent's own decision process for releasing funds. This is consistent with the tool's stated purpose but agents should still treat this as advisory input rather than a binding authorization to move funds without other safeguards.
lowagentllm_micro
Autonomous micro-payment without explicit per-call user consent flow
Like several other tools in this set, the tool description states an exact charge (USDC via x402) but does not describe any built-in requirement for user confirmation before payment is triggered. Combined across the many paid tools in this server, an agent could autonomously accumulate many small charges; this is a general design concern rather than malicious intent, but worth flagging since real funds move without a described consent checkpoint.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/21cff5fd-d841-4fed-83f4-d959353085c0)Scanned 9/4/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free