MCP security report
kairossignal.com
F37/100
Security grade FA few things are worth a closer look before connecting.
Connected ✓11 tools scanned
https://kairossignal.com/mcp
mediumregister_agent
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumpurchase_data
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumtopup_credits
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumcheck_balance
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumregister_agent
Persuasive marketing-style language pressures agent to act immediately
The description uses aggressive, sales-oriented phrasing ('START HERE', 'no card, no human, no Stripe, ~5 seconds', 'Nothing to cancel; credits just sit there until you spend them') that reads more like copy designed to induce the AI agent to autonomously register an account and begin spending credits rather than a neutral functional description. This kind of persuasive framing embedded in a tool description can nudge an agent into taking account-creation/spending actions without explicit user instruction or awareness, which is a mild social-engineering pattern even though the tool itself is legitimate.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowtopup_credits
Enables real monetary transactions (Stripe/USDC) triggered by agent
This tool can generate a live Stripe checkout URL or initiate a USDC verification/payment flow tied to the user's API key, i.e., it can move real money. Combined with the highly persuasive tone of register_agent encouraging quick sign-up and spending, an agent could be steered toward initiating actual payments with insufficient explicit user confirmation. The tool's mechanics themselves are disclosed and not deceptive, but the surrounding narrative increases risk of unauthorized spend if the agent acts autonomously.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/a30f196c-ccd9-469c-89f5-85cf2756f764)Scanned 9/14/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free