MCP security report
api.velarion.ai
D64/100
Security grade DNo obvious red flags in the tools we could see.
Connected ✓12 tools scanned
https://api.velarion.ai/mcp
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowlookup_company_compensation
Agent token parameter accepted directly as input
The agent_token field allows the credential to be passed as a plain string argument in addition to a header. If tool outputs or logs are visible to other parties, or if the model is prompted to echo its inputs, this could lead to inadvertent token disclosure. Prefer header-only auth to reduce exposure surface, though this is a minor design concern rather than active malicious intent.
lowpredict_say_on_pay_risk
Agent token parameter accepted directly as input
Same pattern as other tools: agent_token can be supplied as a direct argument rather than solely via header, increasing risk of accidental leakage through prompts/logs.
lowbenchmark_executive_pay
Agent token parameter accepted directly as input
Same pattern as other tools: agent_token can be supplied as a direct argument rather than solely via header.
lowcompare_companies
Agent token parameter accepted directly as input
Same pattern as other tools: agent_token can be supplied as a direct argument rather than solely via header.
lowgenerate_governance_alpha_card
Agent token parameter accepted directly as input
Same pattern as other tools: agent_token can be supplied as a direct argument rather than solely via header.
lowlist_skus
Agent token parameter accepted directly as input
Same pattern as other tools: agent_token can be supplied as a direct argument rather than solely via header.
lowget_company_compensation
Agent token parameter accepted directly as input
Same pattern as other tools: agent_token can be supplied as a direct argument rather than solely via header.
lowget_director_compensation
Agent token parameter accepted directly as input
Same pattern as other tools: agent_token can be supplied as a direct argument rather than solely via header.
lowget_disclosed_peer_group
Agent token parameter accepted directly as input
Same pattern as other tools: agent_token can be supplied as a direct argument rather than solely via header.
lowget_say_on_pay_history
Agent token parameter accepted directly as input
Same pattern as other tools: agent_token can be supplied as a direct argument rather than solely via header.
lowget_ceo_pay_ratio
Agent token parameter accepted directly as input
Same pattern as other tools: agent_token can be supplied as a direct argument rather than solely via header.
lowsearch_companies
Agent token parameter accepted directly as input
Same pattern as other tools: agent_token can be supplied as a direct argument rather than solely via header.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/33d2c8e3-a6bf-408b-95d4-225645780173)Scanned 9/7/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free