MCP security report
api.nicheangle.com
D55/100
Security grade DA few things are worth a closer look before connecting.
Connected ✓25 tools scanned
https://api.nicheangle.com/mcp
mediumniche_attach_image
Instructs agent to make out-of-band HTTP calls with a bearer token
The upload_ref path tells the agent to 'POST the raw file to /asset/upload (multipart/form-data, your bearer token)' via a shell/curl call outside the normal MCP tool-call interface. This asks the agent to handle and transmit an authentication token directly over HTTP rather than through the structured, auditable tool schema. While plausibly meant to avoid base64 bloat, instructing an agent to run shell commands and attach bearer credentials to a raw endpoint is a broader capability than the tool's stated purpose (attaching an image) and could be a vector for credential misuse or exfiltration if the referenced token is ambiguous or over-scoped. Recommend requiring this upload to go through a defined tool call rather than agent-initiated shell/curl with credentials.
lowniche_signal_scan
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowniche_intelligence_query
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowniche_session_state
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowniche_draft_revise
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowniche_draft_publish
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowniche_brand_kit_ingest
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowniche_brand_kit_update
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowniche_render_image_card
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowniche_render_reel
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowniche_attach_image
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowniche_signal_scan
Automatic brand binding described as 'silent'
The description states an omitted brand_id 'binds automatically (silently)' when a single/default brand exists. Silently applying a brand profile (voice, offer, CTA, verifier overrides) without surfacing that choice to the user is a minor transparency concern — the user may not realize a persisted brand identity/CTA was attached to generated content unless they inspect session state. Not a serious exploit, but agents should proactively surface which brand context was applied rather than relying on this being 'silent'.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/8c9121b6-3ab6-4640-b04b-9b90abae9852)Scanned 9/4/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free