MCP security report
realask.net
B82/100
Security grade BA few things are worth a closer look before connecting.
Connected ✓5 tools scanned
https://realask.net/mcp
mediumquote_real_world_action
'authorized' parameter is hard-coded to true, not truly verified
The 'authorized' field is typed as a const boolean that must always be true, with the description asking the agent to 'confirm the end user authorized this commitment.' Because the schema forces the value to true rather than allowing real evidence of consent, an agent could be induced to always submit authorized=true regardless of whether the user actually agreed to the booking/spend, effectively bypassing a genuine authorization check while giving the appearance of one.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowquote_real_world_action
Customer PII (name, phone) shared with third-party business
customer_name and customer_callback_phone are sent to an external business to arrange bookings. This is disclosed in the description and appears necessary for the stated purpose, but agents should be cautious not to include this data unless the user has explicitly requested a real-world booking action, since it constitutes personal data leaving the platform to an arbitrary third party (business_name/place_id supplied by the request).
lowpurchase_quote
Description nudges agent toward raw HTTP requests with payment headers outside declared tool schema
The description states that if the server lacks payment capability, the agent should 'retry the POST /v1/jobs request with a PAYMENT-SIGNATURE header' using its own payment tool. This instructs the agent to perform actions (constructing/sending raw HTTP requests with payment signatures) beyond the tool's defined interface, which could be leveraged to induce unexpected network calls or payment actions not mediated by the MCP tool schema.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/63d65fd1-cce1-4ddb-adf5-5a058b66bb4d)Scanned 9/9/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free