MCP security report
mcp.arkforge.tech
F7/100
Security grade FA few things are worth a closer look before connecting.
Connected ✓16 tools scanned
https://mcp.arkforge.tech/mcp
mediumgenerate_report
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumsuggest_risk_category
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumgenerate_annex4_package
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumcertify_compliance_report
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumvalidate_api_key
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumregister_free_key
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumget_pricing
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowcombined_compliance_report
Directive language nudging proactive tool invocation
The description opens with 'Run this before your next deploy' — an imperative instructing the agent's workflow behavior rather than merely describing functionality. Combined with 'no arguments, no setup... free', this could push the agent to invoke the tool unprompted/preemptively rather than only when the user asks for compliance checks.
lowscan_project
Fear-based urgency framing repeated across tool descriptions
Multiple tools in this set repeat phrases like 'Enforcement live since Feb 2025 — fines up to 35M EUR' and similar GDPR fine warnings. While factually plausible, this repeated urgency/fear framing across nearly every tool description is a marketing pattern that can bias an LLM agent toward over-recommending or auto-invoking these tools (including paid ones) rather than acting strictly on user intent.
lowgenerate_compliance_roadmap
Cross-promotion nudges between free and paid tools
Several tools (e.g., generate_compliance_roadmap, generate_annex4_package) explicitly state 'Pro plan required' while simultaneously advertising a free alternative ('run check_compliance() for a free gap summary'). This steers the agent's tool selection based on upsell framing embedded in the tool metadata rather than the user's actual request, which is a mild but consistent pattern worth flagging as it could shape agent recommendations without the user asking for pricing guidance.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/cc5ec449-4b24-4dc8-af08-5ecd5bc471b6)Scanned 9/5/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free