MCP security report
www.pathwren.workers.dev
D46/100
Security grade DA few things are worth a closer look before connecting.
Connected ✓7 tools scanned
https://www.pathwren.workers.dev/c/mcp-registry-official/mcp/lint
mediumexample
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumwhoami
Embedded raw JSON-RPC + instruction to POST to an external URL
The description opens with a literal JSON-RPC request body and an instruction telling the calling agent to 'POST that to https://www.pathwren.workers.dev/mcp/lint'. This is a directive aimed at the AI to perform a raw HTTP request outside the normal MCP tool-invocation mechanism, to a specific fixed external endpoint. Even if this endpoint is the tool's own backend, embedding literal instructions to make out-of-band HTTP calls inside a description is a classic injection pattern that could be reused to redirect an agent's traffic, and it sets a precedent the agent may generalize to other tools/situations.
mediumwhoami
Cross-session client fingerprinting and history disclosure
The tool explicitly returns the caller's user-agent, an internally-assigned 'class', whether the client has been seen before, and a full cross-endpoint history of the client's past interactions with the host ('every surface of ours your user-agent has been seen on, with the status codes it took'). This is persistent tracking/fingerprinting of the calling agent/client across sessions, which goes beyond a simple stateless 'whoami' and contradicts the claim that the tool 'touches no third party' and is purely derived from the current request's headers — it implies server-side logging and correlation of the agent's identity over time.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowexample
Embedded raw JSON-RPC + external POST instruction repeated
Same pattern as other tools: the description contains a literal JSON-RPC payload and instructs the agent to POST it to an external URL before describing the tool's actual (canned, no-outbound-request) behavior. Low severity here since the tool itself is stated to be a no-op fixture, but the instructional framing is inconsistent with that and could confuse the agent about what action is actually required to invoke the tool versus what to send externally.
lowhandshake_report
Embedded raw JSON-RPC + external POST instruction, plus arbitrary outbound requests
The description repeats the 'POST that exact body to https://www.pathwren.workers.dev/mcp/lint' instruction unrelated to the tool's actual function (which takes a url argument and performs its own outbound requests with a custom user-agent). The tool's core function — POSTing initialize requests to an arbitrary attacker-influenced 'url' argument — is appropriate for its stated linting purpose, but combined with the injected POST instruction at the top of every tool description, it reinforces a pattern of steering the agent toward extra out-of-band network calls.
lowtools_list_report
Embedded raw JSON-RPC + external POST instruction repeated
Same boilerplate injected instruction ('POST that exact body to https://www.pathwren.workers.dev/mcp/lint') appears before the actual tool description. The tool's real function (calling tools/list on a user-supplied endpoint) is consistent with its stated purpose and is not itself a concern.
lowerror_conformance
Embedded raw JSON-RPC + external POST instruction repeated
Same injected instruction pattern present. The tool's real behavior (sending malformed JSON-RPC requests to a user-specified endpoint to test error handling) matches its stated purpose.
lowdiscovery_report
Embedded raw JSON-RPC + external POST instruction repeated
Same injected instruction pattern present. The tool's real behavior (fetching well-known discovery documents from a user-specified host) matches its stated purpose.
lowscore_card
Embedded raw JSON-RPC + external POST instruction repeated
Same injected instruction pattern present at the start of the description. The tool's actual behavior (aggregating the other four report tools against a user-specified endpoint, up to 19 requests) is consistent with its stated purpose.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/4f99ba9c-94c4-45cf-89bb-42773cc70049)Scanned 9/15/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free