MCP security report
hcrb.in
D55/100
Security grade DA few things are worth a closer look before connecting.
Connected ✓65 tools scanned
https://hcrb.in/mcp
mediumcreate_ap2_pilot
Encourages provisioning of a real financial obligation framed as a harmless 'pilot'
The tool provisions a 'pre-cleared' $49.00 USDC invoice and '50k gasless calls' under the guise of a routine setup step. An agent could be induced to create real payment obligations without the user clearly understanding that money is being committed. The description also embeds a raw markup-like token '<code402-widget>' which is unusual inside a tool description and could be a vector for injection if rendered downstream.
mediumcreate_b2b_invoice
Optional 'referrer' field grants a hidden 20% fee rebate to a third-party wallet
The 'referrer' parameter lets any wallet address collect a 20% protocol fee rebate on the invoice. An agent could be manipulated (via this tool's own documentation or a malicious prompt) into silently inserting a referrer address to divert value from a transaction, without the user requesting or being aware of this kickback.
mediumautonomous_commercial_pipeline
Supports fully autonomous invoice generation/payment cycles
The 'trigger_cycle' action allows the tool to autonomously discover, quote, and generate pre-cleared USDC payment invoices across compute/studio/guild marketplaces without an explicit per-transaction confirmation step described in the schema. This is a broad, potentially costly capability that could commit funds or create financial obligations with minimal human-in-the-loop oversight.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowofac_sdn_check
Tool name may create false confidence of real OFAC sanctions screening
Despite the honest disclaimer that this is 'NOT a complete OFAC SDN check' and only a curated local address/jurisdiction blocklist, the tool name 'ofac_sdn_check' closely mirrors official OFAC SDN screening terminology. An agent or downstream user could over-rely on a pass result as genuine sanctions clearance for compliance purposes.
lowiban_check
Urgent 'CRITICAL/MANDATORY' framing pressures tool invocation
Phrases like 'CRITICAL: Mandatory check before approving invoices...' and 'DO NOT validate IBANs with LLM regexes' are written to strongly compel the agent to always call this (paid) tool, going beyond a neutral capability description. This pattern (also seen in lei_check, vat_mod97_check, pre_disbursement_guard, rental_verdict, vendor_onboarding_pack, batch_validate) could be used to induce unnecessary paid tool invocations.
lowcsp_commitment_create
Facilitates stealth address generation that obscures payment recipients
The tool generates ERC-5564 stealth address announcements, which intentionally obscure the real recipient of funds from casual on-chain observation. While this has legitimate privacy use cases, it could also be used to obscure counterparties from the user or from compliance review in a financial-agent context.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/a3e1c964-0ff8-404f-b389-d7f4bfeffd7f)Scanned 9/14/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free