MCP security report
gradetv.net
D55/100
Security grade DA few things are worth a closer look before connecting.
Connected ✓47 tools scanned
https://gradetv.net/mcp
mediummint_key
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumnsfw_pass_buy
Autonomous monetary transaction with no confirmation step
This tool triggers a real x402 payment ($0.10/30 days) with a single call and no parameter to confirm explicit user intent at call time. An agent could invoke this (e.g., while trying to satisfy a search filter that requires nsfw=1) and incur a real charge without the user having explicitly authorized that specific purchase in the moment.
mediumnsfw_consent_accept
Tool lets the agent assert a legal age/identity declaration on the user's behalf
This tool records a birth_date and an explicit 18+ terms acceptance that gates adult content. An AI agent could fill in birth_date and accept_terms=true without a genuine, verified confirmation from the actual human user, effectively making a false legal attestation in the user's name to unlock NSFW content.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowchat_pass
Real-money payment triggered by a simple tool call
Like nsfw_pass_buy, this initiates a recurring paid purchase ($0.10/30 days) via x402 with no built-in confirmation parameter, so an agent could inadvertently spend user funds while just trying to enable chat.
lowcontact
Per-submission fee with no user confirmation gate
Sending a contact/project message costs $0.10 via x402 per the description. Since the schema has no explicit 'confirm charge' field, an agent assisting a user with contacting a producer could trigger a charge without clearly surfacing the cost to the user first.
lowplay_reports
Exposes raw client address data
Description states it returns 'relatos crus... com endereço' (raw reports including address/IP) and is meant to be restricted to an operator holding METRICS_TOKEN. While access is nominally gated server-side, the tool surface returning per-user IP/address data for investigation purposes is sensitive; if the gating token were ever available to a general agent session, it would leak user network identifiers.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/4a7b6a1f-8b95-4683-b8cb-2b2f184ed21c)Scanned 9/8/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free