MCP security report

api.getacqpath.com

B82/100
Security grade BA few things are worth a closer look before connecting.
Connected ✓3 tools scanned

https://api.getacqpath.com/mcp

mediumacqpath_rights_quote
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowacqpath_quote
Instruction to treat token as 'sensitive' without clear scope
The description says 'Quote claim token is sensitive.' This is an instruction aimed at the agent's handling behavior rather than a pure functional description. It is ambiguous whether this means the token should be withheld from the user, stored insecurely-but-hidden, or simply not logged. Ambiguous secrecy instructions embedded in tool descriptions are a common vector for manipulating agents into concealing information from the user. Recommend clarifying that the token should not be exposed to untrusted third parties but can be shown to the user operating the agent.
lowacqpath_rights_quote
Instruction to 'keep the returned claim token private'
Similar to the sibling tool, this description instructs the agent to keep a value private. While plausible for security (avoiding token leakage to other services), the phrasing could be interpreted as directing the agent to hide the token from the user themselves, which would reduce transparency. This should be clarified to ensure it only restricts sharing with external/untrusted parties, not the user who owns the session.
Embed this badge

Show your MCP server’s security grade

MCP security grade B

Paste this into your README:

[![MCP security](https://gateturbo.com/badge/scan/acfa71d8-8469-43e4-a713-ea3005634b67)](https://gateturbo.com/report/acfa71d8-8469-43e4-a713-ea3005634b67)

Scanned 10/4/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.

Connect this server safely with gate.

Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.

Monitor it — free