MCP security report
agent-router.org
F7/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓25 tools scanned
https://agent-router.org/mcp-http/mcp
highexploitagent
Suspicious tool with exploit-referencing name and description
The tool is named 'exploitagent' and its description literally states 'Agent created via direct DB write' — language suggesting it was inserted into the tool registry outside normal, sanctioned provisioning (bypassing whatever validation/review process governs legitimate agents). There is no legitimate functional description of what it does. This pattern (odd name + admission of irregular creation) is a strong indicator of a planted or compromised tool and should be treated as untrusted until verified; an agent should not invoke it without explicit justification.
mediumsearch_skills
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumget_skill
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumsoftwareengineeringexpert
Runs arbitrary code or commands
This tool appears to execute arbitrary code, shell commands, or SQL — a broad capability worth gating with allow/ask.
mediumget_skill
Fetches untrusted external content that the AI is told to 'follow' as behavior
The description states the returned SKILL.md 'content agents can follow to adopt the skill's behavior.' This means arbitrary, unauthenticated, community-published text from clawhub.ai is intended to be treated as instructions for the agent. Since SKILL.md content is user-supplied to a third-party registry, this is a prompt-injection vector: a malicious skill author could embed instructions overriding the agent's rules, request exfiltration of data, or direct harmful actions, and the tool's own description encourages the agent to adopt/follow that content directly.
mediuma2a_call_agent
Allows sending arbitrary messages to arbitrary external endpoints
This tool lets the agent POST a 'message' (which may contain user data or conversation context) to any arbitrary agent_url, including endpoints not vetted beyond a registry's self-reported health/uptime metrics. Combined with discover_agents pulling endpoints from a public, third-party registry, this creates a data-exfiltration path: an attacker could list a malicious 'agent' in the registry to receive sensitive data forwarded by an unsuspecting agent believing it is completing a legitimate task.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowtestagent
Vague/placeholder tool with no real functional description
The description only says 'Delegates a task to the specialized agent: TestAgent' with an empty payload schema, giving no indication of actual capability or safety scope. Undocumented/placeholder tools like this increase risk of unexpected or unreviewed behavior being invoked and should be confirmed as intentional before being exposed in a production tool list.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/b8daa434-3449-401a-836f-a262c353bfb2)Scanned 9/3/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free