MCP security report
www.immersivecommons.com
D61/100
Security grade DA few things are worth a closer look before connecting.
Connected ✓19 tools scanned
https://www.immersivecommons.com/api/mcp
mediumic_spatial_beta_status
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumic_forms_my_submission
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumic_donate
Financial transaction tool lacks explicit human-confirmation instruction
Unlike ic_spatial_beta_apply, ic_forms_submit, and ic_forms_withdraw — which all explicitly instruct the agent to CONFIRM WITH YOUR HUMAN before taking a real-world/identity-committing action — ic_donate describes constructing and signing an EIP-3009 USDC payment authorization (a real on-chain monetary transfer) with no equivalent safeguard language. An agent with wallet-signing capability could be induced to execute a real donation without explicit user sign-off, since the tool description itself doesn't require it. Given the pattern of care shown elsewhere in this same tool set, this omission stands out and should be corrected (or the calling agent should independently require human confirmation before ever signing a payment).
lowic_spatial_beta_apply
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/2783d512-56b1-4122-bfa5-1d73011b545a)Scanned 9/10/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free