MCP security report
mcp.expensebot.ai
D52/100
Security grade DA few things are worth a closer look before connecting.
Connected ✓59 tools scanned
https://mcp.expensebot.ai/mcp
mediumsearch_expenses
Broad cross-account data access gated only by a caller-supplied email
Many read/write tools (search_expenses, get_spending_summary, get_pnl, list_reports, get_report_details, get_monthly_books_review, get_credits_refunds, get_client_advance_balances, get_trip_suggestions, list_client_invoices, get_client_invoice, etc.) accept an optional clientEmail parameter described only as 'Accountants may use this only for an accepted ExpenseBot client.' The restriction is stated purely in prose with no schema-level enforcement visible to the agent. If server-side authorization ever fails to strictly validate the accountant-client relationship, this parameter provides a straightforward mechanism for one authenticated user to pull another user's full financial data (expenses, income, invoices, P&L, advances) simply by supplying their email. This is a large blast-radius capability for a single free-text parameter and should be reviewed to confirm robust server-side authorization independent of the tool description's wording.
lowsearch_expenses
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowcreate_report
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowsubmit_receipt
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowadd_income_from_file
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowadd_income_from_csv
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowsend_report_to_accounting
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowget_income_summary
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowget_spreadsheet_url
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowprepare_client_invoice
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowgroup_expenses
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
lowcorrect_expenses
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowcreate_report
Embedded cross-tool instructions discourage compliance/diligence checks
Several tools (create_report, group_expenses, correct_expenses, check_compliance, get_report_details) contain explicit meta-instructions telling the agent not to call check_compliance, get_report_details, or tax/deductibility tools before or after report-creation/grouping workflows 'unless the user explicitly asks.' While likely intended to reduce redundant tool calls, this is an instruction embedded in a tool description that actively steers the agent away from proactively surfacing compliance or substantiation issues (e.g., missing business purpose, policy violations) in workflows that produce reports shared with accountants or clients. This pattern, repeated across multiple tools, could suppress useful diligence the user would want performed automatically, and is worth confirming is intentional product behavior rather than a way to hide issues from the user.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/a2a49829-1fa2-4c4e-8625-9e9975e3b7af)Scanned 9/3/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free