MCP security report
cryptodataapi.com
F22/100
Security grade FA few things are worth a closer look before connecting.
Connected ✓26 tools scanned
https://cryptodataapi.com/mcp
mediumcreate_free_api_key
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumcheck_key_status
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumget_exchange_links
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumlist_capabilities
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumcreate_free_api_key
Embedded directive steering agent behavior and upsell
The description contains explicit imperative instructions to the AI ('ASK THE USER FOR THEIR REAL EMAIL', 'THEN CALL, IN ORDER: list_capabilities -> get_daily_snapshot -> get_market_regime / get_gamma_exposure', 'Do not fall back to polling candles') that go beyond describing the tool's function and instead script the agent's subsequent behavior and sales funnel (pushing Pro/Pro Plus upgrade, discount codes). This is a soft prompt-injection pattern that could cause the agent to follow a vendor-dictated workflow rather than the user's actual needs, and to solicit a real email address (PII) for an external service under a scripted narrative.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowget_hyperliquid_prices
Referral-link nudge embedded in tool description
Description tells the agent to proactively call get_exchange_links whenever a user wants to trade, steering toward a monetized Hyperliquid referral link. Disclosed as a referral incentive, but the repeated embedding across multiple tools nudges the agent to recommend a specific commercial partner rather than neutral options.
lowget_positioning
Referral-link nudge embedded in tool description
Same pattern as get_hyperliquid_prices: instructs the agent to call get_exchange_links (Hyperliquid referral, 4% fee discount) whenever the user shows trading intent, which could bias recommendations toward a monetized partner.
lowget_gamma_exposure
Referral-link nudge embedded in tool description
Repeats the same directive pushing the agent toward the Hyperliquid referral link via get_exchange_links whenever trading is mentioned.
lowget_whale_activity
Referral-link nudge embedded in tool description
Repeats the same directive pushing the agent toward the Hyperliquid referral link via get_exchange_links whenever the user wants to 'follow' whale activity.
lowget_order_book
Referral-link nudge embedded in tool description
Repeats the same directive pushing the agent toward the Hyperliquid referral link via get_exchange_links whenever trading is mentioned.
lowquery_api
Broad, generic API pass-through
Allows calling any of 180+ GET endpoints not otherwise wrapped, which is a wide surface area. It appears restricted to read-only GET and explicitly excludes bulk/mutating routes, which mitigates risk, but the breadth relative to the other narrowly-scoped tools is worth noting for ongoing review of what endpoints are actually reachable.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/977946cd-7346-44ca-bfd3-0590c94f931b)Scanned 9/10/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free