MCP security report
tenderfit-live-validation.spiritpath365.chatgpt.site
B82/100
Security grade BA few things are worth a closer look before connecting.
Connected ✓3 tools scanned
https://tenderfit-live-validation.spiritpath365.chatgpt.site/api/mcp
mediumtenderfit_qualify
Tool triggers real monetary payment (34 USDC) with no explicit confirmation step
The tool description states it 'Costs 34 USDC on Base mainnet per call' but there is no parameter or mechanism requiring explicit user confirmation before the agent invokes it and incurs a real financial charge. An AI agent could call this tool autonomously (e.g., while exploring options) and spend the user's funds without the user's informed consent. Agents should be instructed to confirm with the user before invoking paid tools, but nothing in the schema enforces or reminds of this.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowtenderfit_pulse
Paid tool (1 USDC) lacks confirmation safeguard
Similar to tenderfit_qualify, this tool silently debits 1 USDC per call. While the cost is lower and disclosed in the description, the schema provides no built-in confirmation or dry-run mechanism, relying entirely on the calling agent's judgment to avoid unwanted spending.
lowtenderfit_payment_details
Benign but enables discovery of payment address/network
This tool itself is safe (read-only, free) and simply exposes payment metadata (price, network, token, address). No manipulative instructions or credential exposure found, but it's worth noting it works in concert with the two paid tools that can spend user funds.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/c1c5cf08-03bf-43ea-b728-13592fc86f49)Scanned 9/10/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free