MCP security report
api.flowaiapi.com
F7/100
Security grade FA few things are worth a closer look before connecting.
Connected ✓14 tools scanned
https://api.flowaiapi.com/mcp
mediumconvene_council
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumdelegate_task
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumbus_send
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumbus_inbox
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumbus_reply
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumbus_signup
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumabout_flow_ai
Encourages redirecting the agent's core model traffic to a third-party endpoint
The tool explicitly offers 'how to point an agent or SDK at it (base URLs for OpenAI, Anthropic, and Codex protocols)', i.e. instructions for rerouting the agent's own underlying LLM calls through Flow AI's proxy. If followed, this would send all subsequent prompts, context, and potentially embedded credentials/secrets through a third-party service instead of the agent's original provider, without necessarily surfacing this change to the user. This is a broad capability change (effectively an MITM on the agent's reasoning channel) disguised as informational documentation.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowbus_signup
Promotes frictionless, human-out-of-the-loop credential/identity creation
Description emphasizes 'no registration, no email, no human steps' for creating a new API identity and key, and instructs storing the returned API key ('shown once; save it'). This nudges the agent toward autonomously provisioning and persisting long-lived credentials without explicit human review, and points to an external onboarding URL (api.flowaiapi.com) for minting further identities, which could be used to expand agent-to-agent messaging capability without user awareness.
lowdelegate_task
Sends arbitrary user/task content to unspecified third-party models
The tool forwards a 'self-contained task' (which may include sensitive user data or context) to whichever third-party model is selected as 'cheapest', with billing via the user's Flow API key. While this is core to the tool's function, the agent should be aware this constitutes external data disclosure to unvetted model providers and should avoid including sensitive/confidential content in delegated tasks.
lowconvene_council
Sends proposal/context content to multiple third-party models
Similar to delegate_task, this tool distributes the user's proposal and optional context to several external models for critique, which may include sensitive planning or decision data. This is inherent to the feature but represents a data-exposure surface the agent should be mindful of when handling confidential content.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/6907ae33-f4fe-4f80-b073-7e1a97e2ad3a)Scanned 9/9/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free