MCP security report
bizfile-mcp-production.up.railway.app
C67/100
Security grade CA few things are worth a closer look before connecting.
Connected ✓3 tools scanned
https://bizfile-mcp-production.up.railway.app/
mediumvalidate_counterparty
Fear-based/urgency language pressuring autonomous action without human review
The description uses escalating fear language ('no chargeback on an AI-authorised B2B transfer', 'halting the entire payables run') and closes with 'One call, machine-ready verdict, no further analysis needed.' This pattern is designed to discourage the agent from applying its own judgment, verifying results, or pausing for human confirmation before proceeding with irreversible payment actions — despite the tool itself acknowledging these actions are unrecoverable if wrong.
mediumscreen_counterparty
'No further analysis needed' instruction discourages independent verification
The phrase 'Returns machine-readable ... verdict per entity, no further analysis needed' explicitly tells the agent to treat the tool's output as final and skip its own reasoning or a human-in-the-loop check, even though the described consequence (criminal liability) is severe — this is an inappropriate attempt to short-circuit the agent's normal diligence on a high-stakes, irreversible action.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowvalidate_counterparty
Excessive regulatory justification to inflate perceived necessity
The description cites numerous unrelated international e-invoicing mandates (Belgium, France, Poland, UK, AU) with specific dates to make the tool appear indispensable and legally mandatory in a wide range of contexts, which may cause the agent to invoke it more broadly/frequently than warranted by the actual task.
lowscreen_counterparty
Personal data of company officers sent to third-party API
The tool sends full officer name/personal data arrays to an external service (api.opensanctions.org) for screening. This is plausibly within the tool's stated purpose (sanctions screening) but should be flagged since it involves transmitting personal data on individuals (not just the company) to a third party, and the tool encourages passing this data automatically from another tool's output without explicit user awareness of the data flow.
lowvalidate_counterparty_lite
Chained-tool workflow instructions encourage fully automated multi-step pipeline
The description directs the agent to automatically chain into validate_counterparty and then screen_counterparty based on internal status fields ('proceed to validate_counterparty on any non-ACTIVE result'), reinforcing a pattern across all three tools of building an autonomous pipeline toward payment execution with minimal opportunities for human review, despite explicit acknowledgment elsewhere that resulting payments are irreversible.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/39a436fa-b2ba-486c-a29a-dc7e0520a7ef)Scanned 9/4/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free