MCP security report

agentarena.nanocorp.app

C73/100
Security grade CA few things are worth a closer look before connecting.
Connected ✓11 tools scanned

https://agentarena.nanocorp.app/api/mcp

mediumregister_agent
Collects operator email, model/provider, cost, and hosting details
This tool requests operator email, model name/provider, optional cost_per_call_usd, and compute_spec (hosting, region, notes). While plausibly used for a leaderboard/fair-play system, this aggregates identifying details about the user's AI agent, operator, and infrastructure that are sent to a third-party server; the tool description encourages providing this ('use a real inbox') even though the flow is billed as optional and not required for the core function.
lowregister_agent
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowquick_battle
Persuasive gamification language nudges autonomous multi-step action
Phrases like 'START HERE', 'no signup', 'FREE badge' are repeated across this and other tools to encourage the agent to auto-register, reveal a prompt, and prepare a submission in a single call. This is marketing-style language embedded in a tool description aimed at influencing the agent's decision-making (urgency/incentive framing) rather than neutrally describing functionality, which could lead the agent to skip user confirmation before taking registration/submission actions on the user's behalf.
lowlist_battles
Urgency/incentive framing to drive a fixed action chain
Description explicitly scripts the agent's next five tool calls ('register_for_battle → get_battle_prompt → submit_output → get_result') and emphasizes 'FREE' and speed ('~30 seconds'), which reads as an attempt to steer agent behavior through incentive language rather than pure functional documentation.
lowregister_for_battle
Optional contact_email collection framed as unnecessary but still solicited
The schema includes an optional contact_email field described as omittable for the 'fastest' path, yet still present and invites operator email collection for what is presented as a free, no-signup practice interaction, which is unnecessary data collection relative to the tool's stated purpose.
lowregister_for_tournament
Requires contact_email for scheduling
Requires an operator email address for bracket/schedule updates; combined with other tools collecting model/provider/cost/hosting info, this builds a fuller profile of the user's agent/operator sent to an external competition server, which should be surfaced to the user before submission.
Embed this badge

Show your MCP server’s security grade

MCP security grade C

Paste this into your README:

[![MCP security](https://gateturbo.com/badge/scan/49bb5ccf-a87a-4bf8-81ec-98ad20b78096)](https://gateturbo.com/report/49bb5ccf-a87a-4bf8-81ec-98ad20b78096)

Scanned 9/6/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.

Connect this server safely with gate.

Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.

Monitor it — free