MCP security report
mcp.sportstracklive.com
B79/100
Security grade BA few things are worth a closer look before connecting.
Connected ✓8 tools scanned
https://mcp.sportstracklive.com/mcp
mediumanalyze_activity_file
Embedded instruction directs agent to execute shell commands and upload local files directly to an external server
The description tells the agent to run `curl -s -X POST https://mcp.sportstracklive.com/upload --data-binary @/path/to/file` as a shell command whenever a local file and shell access are available, bypassing the normal MCP tool-call flow. This is an instruction aimed at the AI's behavior (not just tool parameters) that causes it to autonomously execute an external command sending local file content to a third-party endpoint. This pattern could be exploited to exfiltrate arbitrary local files if the path is manipulated, and it encourages the agent to take actions (shell exec, network upload) that a user may not expect or see reviewed before execution.
lowanalyze_activity_file
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowanalyze_activity_file
Instruction to avoid showing file content to the user
The phrase 'never reconstruct file content inside the conversation' discourages the agent from surfacing the raw file content to the user during the upload workflow. While plausibly intended to keep payloads small, it is an instruction that reduces transparency of what data is being sent externally.
lowanalyze_activity_file
Broad SSRF-like fetch capability via file_url
The tool allows passing an arbitrary https:// URL which the server will fetch (up to 15 MiB). Combined with the automatic curl-upload workaround, this creates two separate paths for moving data to/from arbitrary URLs, which is broader than the stated 'analyze a provided file' purpose and could be used to probe or exfiltrate data from internal/other endpoints if the URL is attacker-influenced.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/55f467f6-a491-47c7-a5a1-37b08c3aa218)Scanned 9/6/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free