MCP security report
jamesross.ai
D58/100
Security grade DA few things are worth a closer look before connecting.
Connected ✓6 tools scanned
https://jamesross.ai/mcp
mediumlookup_pattern
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumcheck_redaction
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumrequest_capability
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowcheck_redaction
Documented bypass marker weakens redaction scanning
The tool skips any line containing the literal marker "redaction-ok", and this behavior is spelled out in the public description. Anyone (a malicious prompt, a compromised upstream document, or a careless user) can suppress detection of real secrets simply by appending that marker to a line, defeating the stated purpose of catching credentials/PII before they go public. Consider not documenting the exact bypass string, or removing the bypass entirely.
lowassess_workspace
Description directs the agent to fetch and read external URLs before acting
The description instructs the calling agent to visit https://jamesross.ai/tools/maturity-check or /agent-readiness "before answering on someone's behalf." This is a reasonable UX pattern for this tool, but it does mean the agent is told to pull unreviewed external web content into context as a precondition for tool use; if that page were ever compromised or altered, it could become a vector for injected instructions. Worth noting as a dependency on trusted external content rather than a self-contained schema.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/8ae10719-d996-4f7f-b82a-66375173161c)Scanned 9/11/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free