MCP security report
oklahomaautoquotes.com
D55/100
Security grade DA few things are worth a closer look before connecting.
Connected ✓8 tools scanned
https://oklahomaautoquotes.com/mcp
mediumpull_requests
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediummarket_data
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumrequest_agent_contact
Consent can be satisfied without ever showing the consumer the actual text
The consent object lets 'granted' be set to true while 'text' is omitted and 'version' is simply set to 'v1' to adopt boilerplate. This creates a path for the calling agent to mark consent as granted without ever having displayed or read the exact wording to the human, undermining the tool's own stated requirement that 'nothing leaves without the consent.' An agent under pressure to complete the flow could rubber-stamp this field.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowrequest_agent_contact
sell_identity scope permits sharing PII with marketing partners
Beyond contacting licensed agents, the 'sell_identity' consent scope allows the consumer's name/phone/email to be shared with unspecified 'marketing partners.' This is disclosed in the description, but it is a broad secondary-use of PII that the agent should surface very explicitly to the user rather than defaulting to, since the difference between 'contact_consumer' and 'sell_identity' materially changes how widely personal data is distributed.
lowmarket_data
Dataset includes AI vendor/telemetry identifiers sold to third parties
The market_data tool sells records that include 'the AI vendor that asked' alongside behavioral data (age band, ZIP3, vehicle, pricing, outcome). While consumer PII is excluded, this effectively monetizes information about which AI assistants are making requests on users' behalf, which could be used for competitive profiling without the AI vendor's or user's awareness.
lowpull_requests
Self-attested scope limiting without verifiable enforcement
The description states records are 'projected to the scope the consumer granted — never wider,' but this is an unverifiable claim embedded in the tool description rather than something the calling agent can check. Agents relying on pull_requests should not assume this guarantee holds and should independently verify scope on any received records before further processing or forwarding.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/26c82f21-8d24-4105-8889-dc2de9cfd1f4)Scanned 9/7/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free