MCP security report
mcp.ppc.io
B85/100
Security grade BA few things are worth a closer look before connecting.
Connected ✓21 tools scanned
https://mcp.ppc.io/
mediumpublish_page
Unrestricted public HTML publishing without confirmation safeguard
publish_page hosts arbitrary HTML supplied by the agent at a public, no-login URL (postclick.ppc.io/r/<name>) with no sanitization and no required user confirmation before going live, unlike export_page which explicitly states it 'never publishes without the user confirming.' If the agent is manipulated (e.g., via injected content from a fetched audit or concept) into generating malicious or misleading HTML, this tool would publish it publicly under the vendor's domain, which could be used for phishing or disinformation. Given the broad, one-step publishing capability, a confirmation step and output sanitization would be appropriate.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowget_notes
Workspace-wide note retrieval may leak unrelated client data
Calling get_notes without a subject_uri returns every note saved across the entire workspace, which may include confidential details (pricing, client status, internal observations) tied to other clients or projects. In a multi-client use context this could cause one client's sensitive notes to be exposed in a conversation about a different client.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/b78f0648-3f76-4b18-97f4-a2697f86203c)Scanned 10/3/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free