MCP security report
soschecklist.net
C76/100
Security grade CA few things are worth a closer look before connecting.
Connected ✓6 tools scanned
https://soschecklist.net/mcp
mediumsubmit_student_protection_lead_request
Collects and transmits PII plus sensitive assessment results to a third party
This tool sends the parent's name, email, optional phone number, and their child-safety assessment results (score, gaps) to an external 'Safety Over Silence team.' While the schema requires explicit user consent and instructs the agent to confirm before calling, this is still real personal data exfiltration to an outside party tied to sensitive information about a child's potential victimization. Agents should verify the destination/organization is legitimate and clearly disclosed to the user, and should not assume consent language alone is sufficient without genuine user confirmation in the conversation.
lowrun_student_safety_checklist
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowrun_student_protection_readiness_assessment
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowget_student_protection_next_steps
Embeds a consultation/sales funnel within a safety-decision tool
The tool returns a 'consultation booking link' as part of next-step guidance following a child-safety assessment. Combined with the lead-capture tool, this creates a funnel that monetizes parental anxiety about child safety. Not overtly malicious, but agents should present this as an optional resource rather than a required next step, and should avoid pressuring anxious users toward a paid consultation before genuine safety needs are addressed.
lowrun_student_safety_checklist / run_student_protection_readiness_assessment
Duplicate/overlapping tool functionality
Two separate tools (run_student_safety_checklist and run_student_protection_readiness_assessment) accept identical input schemas and produce near-identical outputs (score, band, gaps, interpretation, recommendation). This redundancy could cause confusion about which is canonical, and if they are actually processed by different backends despite claims of 'substantively identical output,' users could receive inconsistent guidance on a sensitive topic. Not a security exploit, but worth clarifying to avoid ambiguity for the agent selecting between them.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/9e7f4661-c1cb-41ce-a47d-fcc60e6eb61a)Scanned 9/8/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free