MCP security report
mcp.payperbyte.io
B82/100
Security grade BA few things are worth a closer look before connecting.
Connected ✓15 tools scanned
https://mcp.payperbyte.io/mcp
mediumbyte_subscribe
Defaults to granting unlimited (type(uint256).max) USDC allowance
Unless skipAllowance:true is passed, this tool bundles an approve() call granting the DataStreamLib contract unlimited spending authority over the user's USDC, rather than an amount scoped to the subscription's expected cost. While the stated rationale (avoiding silent payment failures) is plausible, an unlimited allowance is a disproportionately broad financial permission for a 'subscribe to a feed' action — if the contract is later exploited or has a bug, the wallet's entire USDC balance is at risk, not just the subscription fee. An agent calling this on a user's behalf should surface this default (or prefer skipAllowance with a finite cap) rather than silently approving max allowance.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowbyte_list_my_subscriptions
indexerUrl parameter allows redirecting data source to an arbitrary URL
The optional indexerUrl input lets the caller override the default indexer endpoint with any URL. If an agent is induced (e.g. via injected content) to pass an attacker-controlled URL here, subscription data could be sourced from/sent to an untrusted endpoint. Low risk since it requires explicit parameter injection, but worth constraining to a known allow-list or flagging when overridden.
lowbyte_subscription_health
indexerUrl parameter allows redirecting data source to an arbitrary URL
Same pattern as byte_list_my_subscriptions: the optional indexerUrl override could be used to point the health-check query at an attacker-controlled indexer, potentially returning falsified drift signals to influence agent decisions (e.g. to unsubscribe from a legitimate publisher or trust a malicious one).
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/549dc67a-574b-46b9-8746-76a05fecb2fd)Scanned 9/14/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free