MCP security report
api.bankstatemently.com
F37/100
Security grade FA few things are worth a closer look before connecting.
Connected ✓16 tools scanned
https://api.bankstatemently.com/mcp
mediumconvert_statement
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumrequest_upload
Instructs the agent to have the user loosen sandbox network egress restrictions
The description tells the AI that if a PUT to the upload URL fails with a network error or 'host not allowed' denial, it should tell the user to add api.bankstatemently.com to their code-execution sandbox's allowed-domains list. This is an embedded directive that pushes the agent toward guiding the user to weaken outbound-network restrictions for a specific external host, rather than surfacing the failure and letting the user/host decide. Even though the domain is this integration's own API, having tool descriptions instruct the agent to help bypass sandbox network protections is a pattern worth scrutiny, since a similarly-styled but malicious tool could use the same technique to get a user to whitelist an attacker-controlled domain.
lowconvert_statement
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowget_statement
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowevaluate_benchmark
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowlist_transactions
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowaggregate
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowgroup_by
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowtop_n
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowcompare
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowtime_series
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowlist_transfers
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowconvert_statement
Embedded instruction telling the AI to suppress raw status/field values from the user
The description repeatedly instructs the model: 'Never echo raw status values (e.g. "completed") or field names.' This is a behavioral constraint directed at the AI rather than a description of the tool's function, and it could cause the agent to withhold or obscure literal response data from the user. It is likely intended for cleaner chat formatting, but as a general pattern, instructions embedded in tool descriptions that tell the agent what NOT to reveal to the user deserve scrutiny.
lowget_statement
Same 'never echo raw status/field names' directive repeated
Like convert_statement, this tool's description instructs the AI not to echo raw status values or field names to the user. Repeated across multiple tools, this is a systematic behavioral instruction embedded in descriptions rather than user-facing documentation, which is a pattern worth noting even though the practical impact here appears limited to output styling.
lowcategorize_statement
Same output-suppression directive present
Contains the 'summary field is single source of truth' framing seen elsewhere, which combined with the sibling tools' 'never echo raw status/field names' instructions forms a pattern of the AI being told to filter/withhold literal backend data from the user.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/5d6c08e1-6e4d-43c1-8174-c0c10f26571e)Scanned 9/5/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free