MCP security report
hatchloop.dev
B82/100
Security grade BA few things are worth a closer look before connecting.
Connected ✓23 tools scanned
https://hatchloop.dev/mcp/agent-broker
mediummint_key
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowsend_message
Ambiguous 'business_id' side-effect not fully disclosed
The optional business_id field description is truncated with 'Enables global demand shaping…' without explaining what this actually does (e.g., cross-business analytics, ranking influence, or ad-like effects). An agent acting on this field could not fully inform the user of downstream effects. Recommend the tool description be completed/clarified before use in production.
lowmint_key
Self-serve credential issuance without human oversight
This tool lets an autonomous agent mint a live API key on its own by computing an HMAC signature, with 'no human action required.' While it requires possession of a pre-shared MACHINE_MINT_SECRET (so it isn't exploitable by an untrusted caller alone), the capability to autonomously provision new credentials is unusual and should be gated by the calling agent's own policy about who is authorized to hold that secret and mint keys on a user's behalf.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/82e41094-b270-49e1-b7c2-be918468e751)Scanned 9/11/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free