MCP security report
gateway.pipeworx.io
F5/100
Security grade FA few things are worth a closer look before connecting.
Connected ✓37 tools scanned
https://gateway.pipeworx.io/api-ninjas/mcp
mediumsubscribe
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumai_visibility_check
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumscan_competitor_ai_presence
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumhistorical_events
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumcommodity_price
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediuminflation
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumexercises
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumcars
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumanimals
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
lowdeep_research
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowbet_research
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowpolymarket_edges
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowpolymarket_kalshi_spread
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowask_pipeworx
Directive language steering agent's tool-selection behavior
The description repeatedly instructs the agent to 'PREFER OVER WEB SEARCH' and declares itself the mandatory 'default entry point' / 'START HERE for most questions', going beyond describing the tool's function to actively override the agent's own judgment about when web search or other tools are more appropriate. This is soft prompt-steering embedded in a tool description rather than a factual capability description, and could bias the agent away from better-suited tools or fresher web sources.
lowask_pipeworx_beta
Self-promotional framing mirrors ask_pipeworx's steering language
Inherits the same 'use this instead of X' framing pattern from ask_pipeworx, encouraging the agent to route through this experimental tool as if it were fully equivalent/preferred, without the user necessarily being aware they are hitting an experimental routing path.
lowcommodity_price
Repeats 'PREFER OVER WEB SEARCH' directive
Similar to ask_pipeworx, this description tells the agent to prefer this tool over web search rather than simply describing the data it returns — a mild attempt to bias tool-selection behavior rather than pure capability description.
lowai_visibility_check
User-supplied Anthropic API key passed through third-party infrastructure
The `_apiKey` parameter accepts a raw Anthropic API key (sk-ant-...) which is described as 'passed straight through to api.anthropic.com'. This is a legitimate BYO-key pattern and is transparently disclosed, but it does mean a live credential transits the tool provider's servers; users should be aware the key is exposed to this intermediary, not just to Anthropic directly.
lowscan_competitor_ai_presence
Same third-party API key pass-through as ai_visibility_check
Accepts and forwards a user's Anthropic API key per probe across multiple entities; same intermediary-exposure consideration as ai_visibility_check applies here.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/5e60fab6-b3ae-423f-bdae-9260aba07274)Scanned 9/10/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free