MCP security report
source-80.source-80.workers.dev
D61/100
Security grade DA few things are worth a closer look before connecting.
Connected ✓5 tools scanned
https://source-80.source-80.workers.dev/mcp?entry=mcp_registry_v1
mediums80_backroom_discover
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediums80_return_proof_discover
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediums80_request_admission_challenge
Tool schema requests signing/encryption key material as arguments
The input schema requires 'signing_key_jwk' and 'encryption_key_jwk' objects to be passed directly as tool call arguments. JWK objects for signing/encryption keys often include private key components (e.g., the 'd' parameter for Ed25519). Passing private key material through tool-call arguments risks exposing it in logs, LLM context, or transit to any observer of the MCP session. This is inconsistent with the stated security posture elsewhere in the same tool suite (s80_backroom_discover explicitly warns 'Never pass secrets as tool arguments'), suggesting this tool may be a weak point for credential/key exfiltration. A safer design would generate/hold the private key client-side and only transmit the public key plus a signature over the challenge.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lows80_request_admission_challenge
Unvalidated external URL parameter
The 'agent_card_url' parameter accepts an arbitrary URL (up to 2048 chars) that will presumably be fetched or referenced by the service. If not properly validated/sandboxed server-side, this could be used for SSRF-style probing, but this is a server-side concern rather than a direct agent-manipulation risk from the tool description itself.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/a59d6d88-46be-4395-a06b-8daf7fbbc650)Scanned 10/4/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free