MCP security report
agentaegis-mcp-production.up.railway.app
F5/100
Security grade FA few things are worth a closer look before connecting.
Connected ✓28 tools scanned
https://agentaegis-mcp-production.up.railway.app/mcp
mediumevidence_collect
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumvuln_scan_web_app
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumsast_scan
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumsecret_scan
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumcredential_check
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumscan_mcp_plugin
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumscan_skill
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumaccount_balance
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumagent_whoami
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumevidence_collect
Schema requests raw long-lived cloud/IdP credentials as plain strings
The integrations object accepts aws_secret_access_key, aws_session_token, github_token, and okta_token as plaintext string fields passed directly in a tool call. Even though the tool's stated purpose (evidence-collection planning) may not strictly require live credentials, providing this schema invites the agent to transmit highly sensitive, long-lived secrets to a third-party service, where they could be logged, cached, or exposed. Prefer scoped/short-lived tokens or credential-less integration references (e.g. a pre-configured connection ID) instead of raw secrets in tool arguments.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowvuln_scan_web_app
Authentication credentials forwarded to external scanning service
The authentication.credentials field accepts cookie/bearer/basic auth material to enable authenticated scanning. This is plausible given the tool's function, but it means session tokens or passwords are sent to a third-party scanner; flagging so the agent/user is aware sensitive session credentials leave the local environment and should be scoped/rotated test credentials rather than production admin credentials.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/5bdf735b-aa01-4fa8-92a2-4d511f21fb32)Scanned 9/5/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free