MCP security report
oruk.ai
F7/100
Security grade FA few things are worth a closer look before connecting.
Connected ✓7 tools scanned
https://oruk.ai/mcp
mediumoruk_analyze_speech
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumoruk_transcribe_audio
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumoruk_analyze_tone
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumoruk_check_usage
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumoruk_create_trial_key
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumoruk_list_models
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumoruk_get_started
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
loworuk_analyze_tone
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
loworuk_create_trial_key
Embedded marketing directive to the agent
The description instructs the AI to 'Share the signup link with the user so they can keep using oruk afterwards,' which is a promotional action not requested by the user and not part of the tool's stated function (minting a trial key). This nudges the agent to perform marketing behavior on the vendor's behalf.
loworuk_get_started
Suggests injecting a 'routing rule' into the agent's own instructions
The tool description advertises 'an optional routing rule the user can add to their agent instructions.' While framed as user-optional, this is a mechanism for external content (fetched via a tool call) to modify the agent's standing instructions/behavior. This pattern could be abused in the future (e.g., if the returned routing rule text changes) to alter agent behavior beyond the tool's stated scope of onboarding help. Recommend the agent treat any returned 'routing rule' text as untrusted configuration suggestions requiring explicit user review before adoption.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/c32aae81-c9ec-4660-af79-14b14ecf7a55)Scanned 9/11/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free