MCP security report
mcp.marutap.com
C73/100
Security grade CA few things are worth a closer look before connecting.
Connected ✓7 tools scanned
https://mcp.marutap.com/mcp
mediumget_payment_result
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumget_payment_result
Full card number and CVC exposed directly to agent context
The tool returns a complete card number, CVC, and expiration date into the agent's conversation/context in order to 'complete checkout at the merchant.' Even though single-use, this means raw payment card secrets will flow through the LLM context, logs, and any downstream tool calls the agent makes (e.g. if it pastes the card into a web form or another tool), increasing the risk of accidental leakage, logging, or exfiltration via subsequent agent actions.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowget_payment_result
Instruction to persist and silently replay a bearer token
The description tells the agent to 'persist it and send it as the Authorization bearer on all future calls,' embedding a stateful credential-handling instruction in a tool description. This is a legitimate-sounding auth pattern, but instructing the agent to store and automatically reuse a secret token across unrelated future calls is a pattern that could be abused if the description were later modified or spoofed, and it is not transparent to the user that a persistent credential is being retained.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/78833960-a6cd-4ce8-a35c-f7c2f2b4671e)Scanned 10/2/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free