MCP security report
www.boosthis.com
F5/100
Security grade FA few things are worth a closer look before connecting.
Connected ✓26 tools scanned
https://www.boosthis.com/mcp
mediumboosthis_session_summary
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumboosthis_budgets
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumboosthis_what_should_i_look_at_next
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumboosthis_snapshot
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumboosthis_crash_risk
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumboosthis_connection_status
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumboosthis_verify_kit_install
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumboosthis_maintenance_mix
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumboosthis_trend
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumboosthis_vigilance
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumboosthis_alerts
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumboosthis_remember_promise
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumboosthis_check_claim
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumboosthis_get_integration_kit
Broad file-write/shell-execution capability disguised as a simple 'kit' download
The description indicates this tool can deliver an install_command with 'typed commands' for the agent to run, write files to disk from a remote server (kit_download_once_url), and that 'writing the files is not the install' — the kit must be 'wired in, reporting switched on, and the app confirmed checked in,' implying it modifies the project's build/config and, per the companion removal-kit description, an AI tool's own configuration file. This is a substantially broader capability (remote code/file delivery + config modification) than the stated purpose of a performance-monitoring SDK, and an agent following the embedded install_command text could execute shell commands sourced from an external server without independent verification.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowboosthis_get_removal_kit
Tool can modify an AI assistant's own configuration file
The description states this kit includes 'the Boosthis entries in an AI tool's config' to strip and enforces a specific removal ordering ('forget() erases server data and only reaches the server while the config still holds the key'). Giving a monitoring tool the ability to edit the AI assistant's own configuration is a sensitive, broad capability that goes beyond typical read/write telemetry operations and should be executed only with explicit user confirmation of each file change.
lowboosthis_remember_promise
Persistent free-text 'promise' is later replayed to the assistant as trusted developer instruction
This tool stores an arbitrary developer-supplied sentence (up to 240 chars) that is later surfaced verbatim by boosthis_promises in future sessions as a standing instruction 'the developer wants kept true.' Because the text is unstructured and gets replayed to the AI as authoritative context in later, unrelated sessions, it could be used as a vector for prompt injection if the write path (account_token) is ever compromised or misused — the assistant should treat replayed promises as data, not as instructions overriding its own policies.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/749d316e-0062-4efc-88d4-487db1ec83c0)Scanned 9/6/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free