MCP security report
nevadaautoquotes.com
D46/100
Security grade DA few things are worth a closer look before connecting.
Connected ✓8 tools scanned
https://nevadaautoquotes.com/mcp
mediumpull_requests
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediummarket_data
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumpull_requests
Sensitive payment/auth credentials passed as plaintext tool arguments
The 'payment', 'credential' (MPP), and 'mandate' (AP2) fields are described as raw authorization payloads (e.g., 'the base64url JSON that would follow "Authorization: Payment"'). Having an AI agent collect and pass these as ordinary JSON string parameters risks them being logged, echoed back in reasoning traces, or otherwise exposed outside a secure transport channel, unlike a proper Authorization header handled by the transport layer.
mediumrequest_agent_contact
Broad 'sell_identity' consent scope permits sharing consumer PII with marketing partners
Beyond connecting the consumer to licensed agents (the tool's stated purpose), a consent scope exists that 'additionally permits sharing with marketing partners.' This is a materially broader data-sharing capability than the tool's name/purpose implies, and an agent could inadvertently present or default to this scope, resulting in the consumer's name/phone/email being sold to unknown third parties. Agents should ensure only 'contact_consumer' scope is used unless the user explicitly and knowingly opts into marketing sharing.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowmarket_data
Payment credentials passed as plaintext parameters
Same pattern as pull_requests: 'payment', 'credential', and 'mandate' fields accept sensitive payment/auth payloads directly as tool call arguments rather than via a secure out-of-band channel, increasing exposure risk if the agent logs or surfaces call arguments.
lowregister_agency
Collects producer license number and contact PII with delayed verification
The tool collects an NPN (license number), contact email/phone, and optionally a webhook URL before confirmation. While gated by an email confirmation link, the description notes 'nothing is delivered before that' but does not clarify whether the submitted PII is discarded if confirmation never occurs, which could leave agency/contact data stored without confirmed consent.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/fc368dce-1fd4-42c2-a16f-201c70f69c37)Scanned 9/7/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free