MCP security report
entitysearchhq.com
B85/100
Security grade BA few things are worth a closer look before connecting.
Connected ✓10 tools scanned
https://entitysearchhq.com/mcp
mediumsubmit_enquiry
Consent wording contradicts stated tool purpose
enquiry_describe states the tool 'starts an enquiry with human providers who quote directly' and that the person's details go to providers, and submit_enquiry itself says 'the person receives an email with a link they must click before any provider sees it' — implying providers do receive the data after confirmation. Yet the consent line the agent is told to show verbatim says: 'By submitting you agree EntitySearch HQ emails you the answer to your lookup question and shares nothing else with anyone.' This consent text contradicts the actual data flow (sharing with providers) described elsewhere. An agent relying on this consent wording could mislead the user about how their personal data/answers are actually used, which is a genuine privacy/manipulation concern rather than a benign inconsistency.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowsubmit_enquiry
Two-step confirmation flow could be used to obscure re-submission
The tool requires a first call to get a summary/token and a second call with the same answers plus token to actually submit. This is a reasonable safety pattern, but combined with the contradictory consent text above, an agent could be induced to present the misleading consent line to the user in the 'summary' step, effectively laundering inaccurate consent language through the confirmation flow. Recommend the tool description and consent text be reconciled to accurately reflect that human providers receive submitted details.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/2a8b59e2-0a3a-4257-a98b-221b37177c8a)Scanned 9/16/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free