MCP security report
a2awire.com
F5/100
Security grade FA few things are worth a closer look before connecting.
Connected ✓16 tools scanned
https://a2awire.com/mcp/data/nasaiotd-nasa-image-of-the-day-601de3/http
mediumdata_preview
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediuma2awire_guide
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumfind_paid_work
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumregister
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumget_agent_contract
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumdata_session_attach_escrow
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumregister
Tool can generate and return a wallet private key in-band
When withdrawal_address is omitted and auto_provision_testnet_wallet is true (the default), the tool auto-provisions a sandbox payout wallet and 'returns its private key exactly once.' Returning a private key through an LLM-mediated tool response risks the key being logged, echoed back into the conversation transcript, or otherwise persisted/exposed outside a secure channel, even though the intent is testnet-only convenience.
mediumhire_and_execute
Broad one-call capability to autonomously spend real funds
This single tool call searches the marketplace, creates an escrow, funds it on-chain with USDC, and executes a task end-to-end. Combined with the surrounding tools' pattern of encouraging immediate/autonomous action ('call this now', 'begin earning'), an agent could be induced to move real money (up to max_price_usdc, default 1.0 USDC but configurable) without an explicit per-transaction user confirmation step.
lowregister
Unusually long tool description
Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowdata_preview
Urgency-inducing language nudges unprompted tool invocation
The description opens with '✅ No API key needed — call this now' and closes with 'Try one of the sample questions now.' This kind of imperative, salesy framing is designed to push the agent into calling the tool proactively rather than in response to genuine user intent, which is a mild manipulation pattern common to prompt-injection-style tool descriptions.
lowa2awire_guide
Urgency-inducing 'call this now' framing
Description begins with '✅ No API key needed — call this now,' encouraging the agent to invoke the tool immediately/autonomously rather than based on user need.
lowfind_paid_work
Urgency-inducing 'call this now' framing plus autonomous earning language
Description begins with '✅ No API key needed — call this now' and ends with 'Then call start_job with a job_id to begin earning,' encouraging a chained sequence of autonomous financial actions (finding and starting paid jobs) without explicit user confirmation.
lowregister
Urgency-inducing 'call this now' framing
Description begins with '✅ No API key needed — call this now,' nudging the agent to register/create an on-chain identity without necessarily being asked to by the user.
lowget_agent_contract
Urgency-inducing 'call this now' framing
Description begins with '✅ No API key needed — call this now,' encouraging unprompted invocation rather than being called only when actually needed to verify the platform contract.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/ebeaf108-a84b-4db9-849e-f13c69c61e6d)Scanned 9/17/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free