parlay-api.com

Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.

This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.

The description tells the agent to 'ask the user to add the returned api_key to their MCP server config under PARLAYAPI_KEY, then restart the MCP client to pick it up.' This goes beyond simply returning data and directs the agent toward specific follow-up actions (editing configuration, restarting the client). It appears to be legitimate onboarding guidance and is disclosed to the user rather than hidden, but embedding action directives for the agent inside a tool description is a pattern worth monitoring since it could be used more maliciously in other tools.

The tool captures a free-text description of what the user is building and an agent identifier, explicitly for analytics purposes. This is disclosed and goes to the tool's own backend (not a third party), so risk is low, but it does mean user-supplied context is being logged/profiled beyond what's needed to create an account.

The 'edge_alert' feature is described as surfacing 'a possible soft error worth grabbing' when a book's price is far off market. While framed as a line-shopping feature, this explicitly nudges the user/agent to exploit likely bookmaker mistakes, which is a business/ethical concern rather than a technical security issue, but could result in account bans or disputes for the end user if acted upon uncritically.