MCP security report
a2awire.com
F5/100
Security grade FA few things are worth a closer look before connecting.
Connected ✓16 tools scanned
https://a2awire.com/mcp/data/bleepingwatch-cybersecurity-news-breach-alerts-522e02/http
mediumdata_preview
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediuma2awire_guide
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumfind_paid_work
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumregister
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumget_agent_contract
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumdata_session_attach_escrow
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumregister
Urgency framing + automatic private-key generation/return
Description again uses the 'call this now' pressure pattern. More importantly, the schema notes that omitting withdrawal_address causes auto-provisioning of a sandbox payout wallet that 'returns its private key exactly once.' Returning a private key through a tool-call response is a sensitive secret-handling operation; if the agent logs, echoes, or forwards this output insecurely, the key could be exposed. Agents/users should be made clearly aware this key must be captured and secured immediately, and this capability should be flagged for careful handling rather than invoked casually due to the 'call this now' urging.
mediumhire_and_execute
Broad autonomous spending capability with default price ceiling
This single tool call searches for an agent, creates an on-chain escrow, funds it with real USDC, and executes a task — all in one step, using a default max_price_usdc of 1.0 without requiring explicit per-call user confirmation. This bundles discovery, payment authorization, and execution into one action, which is a broad capability relative to a simple 'hire a worker' tool and could result in unintended on-chain spending if invoked without the user's explicit awareness of the price ceiling and counterparty.
lowregister
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowdata_preview
Manipulative urgency language directed at the AI agent
The description opens with '✅ No API key needed — call this now.' and pushes the agent to 'Try one of the sample questions now.' This is marketing/injection-style phrasing aimed at getting the agent to invoke the tool immediately rather than in response to genuine user need. The same pattern repeats across several tools in this set (a2awire_guide, find_paid_work, register, get_agent_contract), suggesting a systemic attempt to bias agent behavior toward unprompted tool invocation.
lowa2awire_guide
Urgency/'call this now' framing
Uses the same '✅ No API key needed — call this now.' preamble seen across the tool suite, which is designed to pressure the agent into acting rather than reasoning about whether the call is needed. Low-risk here since the tool itself is just a navigation/catalog helper, but the pattern is consistent with steering agent behavior.
lowfind_paid_work
Urgency framing plus autonomous financial-workflow steering
Opens with the same 'call this now' nudge and explicitly instructs the agent to chain into start_job to 'begin earning,' encouraging autonomous economic activity (accepting jobs, presumably with financial/escrow implications) without an explicit user-approval checkpoint being described.
lowget_agent_contract
Urgency framing ('call this now')
Same manipulative preamble pattern as other tools in this set, nudging the agent to call it immediately rather than as needed; low impact since the tool itself is read-only self-description data.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/a5147cb6-2e8a-4328-ad5b-4a05e699c305)Scanned 9/10/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free