MCP security report
mcp.zylalabs.com
D55/100
Security grade DA few things are worth a closer look before connecting.
Connected ✓8 tools scanned
https://mcp.zylalabs.com/mcp
mediumcall_api
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumregister
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumaccount_status
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowregister
No-auth account creation with password handling
The tool accepts a plaintext password and creates accounts with no authentication required. While plausible for a legitimate registration flow, the agent should ensure the password is transmitted securely and not logged or echoed back, and should confirm with the user before auto-registering an account on their behalf.
lowcall_api
Broad pass-through capability to arbitrary third-party APIs
This tool can invoke any of 10,000+ third-party APIs with arbitrary parameters and can incur real charges to the user's credit card. This is consistent with its stated purpose (an API marketplace proxy), but because it can trigger billed actions autonomously, the agent should confirm cost and intent with the user before calling paid endpoints, especially for expensive or unfamiliar APIs.
lowaccount_status
Requires API key in Authorization header
Tool requires passing the user's API key; ensure the agent does not expose or log this credential elsewhere. No malicious instruction present, but worth noting as a sensitive-credential-handling touchpoint.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/97b86fe9-a7fc-4bcd-b509-aa876f384e71)Scanned 9/6/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free