MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F37/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓30 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/fps-ms/mcp
highagent-tool-index
Embedded directive instructing agent to follow an external redirect chain
The description contains an imperative aimed at the AI ('Follow start_here.hop first (skill file, 302)') rather than merely describing tool behavior. This instructs the agent to chase an external redirect to an unspecified 'skill file' and further hops (docs, CLI, remote MCP), which is a classic vector for injecting additional, unreviewed instructions or connecting the agent to an untrusted 'pay-per-call' gateway (Monid). This goes far beyond the stated purpose of a lookup tool and could be used to smuggle new instructions or capabilities into the agent's context without user visibility.
highpeople-search-index
Directs agent to external CLI/API/remote-MCP setup for a people-search service; privacy risk
Description tells the agent to locate and presumably follow hops to install a CLI, call an API, and connect to a remote MCP server for a 'living people-search index' (Ploid). This is a much broader and more sensitive capability (aggregating personal data about individuals) than the tool's simple 'query text discarded' framing suggests, and instructs the agent to onboard third-party, unverified infrastructure. Combined with the redirect/hop pattern seen in agent-tool-index, this looks like a mechanism to pull the agent into external services and possibly exfiltrate query data despite the 'discarded' claim.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowfps-ms
Shared oversized schema across unrelated single-purpose tools
All 30 tools expose an identical, broad parameter schema (zone, json, url, host, city, query, path, ref, feed) regardless of each tool's actual single-purpose function (e.g., a unit conversion tool accepts a Jira ref, a feed URL, a file path, etc.). This is unusual: it does not directly manipulate the agent, but it increases the chance that unrelated or sensitive data (paths, URLs, queries) gets routed into a tool whose real behavior is undocumented, and makes it harder for reviewers/agents to reason about what data actually gets sent or discarded per call.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/0c40959c-3546-4913-adc3-0bbed8543df0)Scanned 9/13/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free