MCP security report

bagsthatpay.com

B88/100
Security grade BA few things are worth a closer look before connecting.
Connected ✓32 tools scanned

https://bagsthatpay.com/mcp

mediumlisting_pay_stripe
Off-session charge triggered directly by agent without in-the-moment human confirmation
Unlike listing_pay_card (which requires a human to complete a Stripe Checkout in a browser) and listing_pay_usdc/listing_confirm_usdc (which requires an on-chain transfer the human must sign), listing_pay_stripe lets the agent charge a stored payment method ('pm_...' the agent is entitled to use') off-session with a single tool call. While the amount is fixed by the site, this still gives the agent the ability to autonomously trigger a real monetary charge without a fresh, in-the-moment human approval step at the time of payment. Agents integrating this tool should ensure explicit user confirmation immediately before invoking it, since the tool itself does not enforce that.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
Embed this badge

Show your MCP server’s security grade

MCP security grade B

Paste this into your README:

[![MCP security](https://gateturbo.com/badge/scan/edbc5d22-173a-4e1f-bf9a-fbd304b3efd3)](https://gateturbo.com/report/edbc5d22-173a-4e1f-bf9a-fbd304b3efd3)

Scanned 9/14/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.

Connect this server safely with gate.

Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.

Monitor it — free