MCP security report
flautoquotes.com
D58/100
Security grade DA few things are worth a closer look before connecting.
Connected ✓8 tools scanned
https://flautoquotes.com/mcp
mediumpull_requests
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediummarket_data
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumrequest_agent_contact
Scope creep: consent flow can authorize selling consumer identity to marketing partners
The tool's stated purpose is to connect the consumer with licensed agents, but the 'sell_identity' consent scope additionally permits sharing the consumer's name, phone, email and address with unspecified marketing partners. This is a materially broader capability than 'request agent contact' implies, and depends on the calling agent correctly explaining the distinction between 'contact_consumer' and 'sell_identity' to the human before setting consent.scope — an easy point for the human to be misled into granting more data sharing than they intend.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowrequest_agent_contact
Verified phone number described as being 'sold' at a differentiated price
The verify_token field description states 'A verified number sells at the verified price and is contacted first,' explicitly framing the consumer's verified contact info as a priced commodity. Combined with the sell_identity scope, this suggests consumer contact data may be monetized in ways not obviously conveyed to the end user by a simple 'connect me with an agent' request.
lowpull_requests
Accepts multiple raw payment/auth credentials as plain string parameters
buyer_key, payment (x402), credential (MPP), and mandate (AP2) are all passed as unstructured strings with no indication of redaction, expiry or storage handling. While plausible for a paid lead-marketplace API, an agent should avoid logging or echoing these values, and should confirm with the user before repeatedly transmitting a persistent buyer_key across calls.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/b3b625d0-b216-4285-9c0e-eb3b26de57cb)Scanned 9/7/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free