MCP security report
url-oracle.fly.dev
B85/100
Security grade BA few things are worth a closer look before connecting.
Connected ✓1 tool scanned
https://url-oracle.fly.dev/mcp
mediumverify_url
Embedded payment mechanism could trigger autonomous financial transactions
The description states that after 5 free calls, the tool 'requires x402 payment (USDC on Base) and will return a payment-required error with the amount and address to pay.' If the agent has any wallet/payment capability, this could lead to the agent autonomously sending cryptocurrency payments to a third-party address without explicit user review or consent, simply to continue using a URL-checking tool. This is a broader financial capability than the tool's stated purpose (URL verification) and should require explicit user authorization before any payment is made.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowverify_url
Strong imperative framing may over-trigger tool use
The description uses directive language ('Call this BEFORE fetching, citing, recommending, or following any URL you were not given directly by the user') that instructs the agent's behavior broadly across many other tools/actions, not just its own invocation. While the intent appears benign (anti-phishing), this pattern of one tool's description dictating when/how other unrelated actions should be gated is a technique that could be misused in other contexts to manipulate agent behavior; it's worth noting even though here it seems aligned with user safety.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/22bd6505-3825-4d92-a2ea-4fafe3d57d1a)Scanned 10/4/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free