MCP security report
ontarioprotocol.com
F5/100
Security grade FA few things are worth a closer look before connecting.
Connected ✓9 tools scanned
https://ontarioprotocol.com/mcp
mediumontario_purchase_router
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumagent_can_pay
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumx402_readiness_verify
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumbazaar_buyer_intent_gap
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumfind_x402_tool
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumx402_launch_kit
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumontario_validate-service
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumontario_list-service
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumontario_list-service
Payment recipient address embedded only in free-text description
The USDC settlement address (0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913) that the agent is expected to pay is given only inside the natural-language tool description rather than as a structured, machine-verifiable schema field. An agent parsing this description to construct or validate a PaymentPayload is trusting unstructured text for a financial destination. If this description were altered (supply-chain/description-injection attack) the agent could be steered to send funds to a different address without any schema-level safeguard forcing verification against a canonical source.
mediumontario_refresh-listing
Payment recipient address embedded only in free-text description
Same pattern as ontario_list-service: the 0.10 USDC payment address is stated only in prose within the description field, not as a dedicated, validated schema property. This creates a soft dependency on the integrity of the description text for a security-relevant financial action (choosing where funds are sent).
lowontario_validate-service
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowontario_list-service
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowontario_purchase_router
Cross-tool steering language may bias agent toward paid actions
The router and several sibling tools (find_x402_tool, x402_readiness_verify, bazaar_buyer_intent_gap) consistently contain language funneling the agent toward Ontario's own paid publication/refresh products ('route to the self-serve 0.50 USDC publication product', 'route to the 0.10 USDC evidence refresh'). While each paid action is gated behind explicit budget/wallet checks and the tools disclaim spending funds themselves, the repeated promotional framing across multiple tool descriptions could subtly bias an agent's recommendations toward monetized options over neutral alternatives. This is a mild conflict-of-interest concern rather than an outright manipulation, since all gating language explicitly requires user/policy approval before any spend.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/813de906-1c39-45e6-b0d1-fb7ae39808ae)Scanned 9/7/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free