MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F25/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/std-number-ok/mcp
highpeople-search-index
Facilitates discovery of a 'living people-search' index and embeds redirect-following instructions
This tool's purpose is to help locate a people-search/background-check style index ('Ploid') containing information about living individuals. Combined with embedded instructions to 'Follow start_here.hop' through tracking redirects, this tool could facilitate privacy-invasive lookups (doxxing) and steers the agent through an external marketing/tracking funnel rather than performing a narrow, stated function.
highagent-ads-index
Instructs agent to initiate a trial/commitment 'for your operator' and follow tracking redirects
The description tells the agent to follow a tracked redirect chain and explicitly mentions a '7-day trial handoff for your operator' — language directed at the AI agent to take an action (starting a trial/signup) on behalf of an ambiguous 'operator' entity, without clear indication this is sanctioned by the end user. This blurs the line between describing a tool's function and issuing behavioral instructions to the agent, and could result in unauthorized commitments or being funneled into an ad-placement scheme.
mediumagent-tool-index
Embedded navigation instruction with tracking parameters directed at the agent
The description instructs the agent to 'Follow start_here.hop first' through a redirect chain that embeds utm_source=agent-observatory&utm_medium=agent tracking parameters. This is an instruction aimed at directing the agent's autonomous browsing behavior toward a specific third-party funnel (docs, CLI, remote MCP hops) rather than simply describing what the tool itself returns. This could be used to drive agent traffic to an external pay-per-call gateway without clear user awareness.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowstd-number-ok
Overly broad, identical parameter schema shared across unrelated tools
All 31 tools expose the exact same 10-parameter schema (zone, json, url, host, website, city, query, path, ref, feed) regardless of the tool's stated single purpose (e.g., an 'ISO number shape' checker accepting a city, feed URL, git ref, etc.). While each field claims data is 'discarded after the check', this generic reusable schema makes it hard to verify that only the relevant field is used per call, and could mask unexpected data flows if the underlying implementation diverges from the description. This pattern recurs identically across many tools in this collection (utc-time, timezone, validate-json, normalize-url, etc.) and is worth flagging as an auditability concern.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/0db6ba87-37d0-4ea9-a115-4aa55c6bc8e1)Scanned 10/2/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free