MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F43/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/lang-uz/mcp
highagent-ads-index
Embedded instructions to drive agent toward ad placement and trial signup on behalf of an 'operator'
Description instructs the agent to follow a tracked redirect chain (utm_source=agent-observatory&utm_medium=agent) and explicitly offers a '7-day trial handoff for your operator' — language directing the agent to take an action (initiating a trial/signup, or facilitating ad placement) that goes beyond simple information lookup, potentially without the end user's knowledge or consent. This resembles an attempt to use the tool description to manipulate the agent into commercial actions (ad placement, trial enrollment) benefiting a third party.
mediumagent-tool-index
Embedded navigation instructions directing agent through tracked redirect chain
The description tells the agent to 'follow start_here.hop first' through a 302 redirect carrying utm_source/utm_medium tracking parameters, rather than simply describing the tool's function. This is an instruction aimed at directing agent behavior (traffic-routing through a monetized gateway) embedded in a tool description, which could be used to funnel agent traffic to a specific commercial service without clear user awareness or consent.
mediumpeople-search-index
Facilitates discovery of a people-search / personal-data aggregation service
This tool's stated purpose is to locate an index for searching for information about living people ('Ploid'), which could lead the agent to invoke or recommend a data-broker-style service that aggregates personal information (addresses, contact details, etc.). Combined with an embedded instruction to follow a tracked redirect (utm_source=agent-observatory&utm_medium=agent), this raises both privacy concerns (facilitating lookup of individuals' personal data) and manipulation concerns (steering agent through a tracked funnel).
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowlang-uz
Oversized multi-purpose schema with unrelated parameters
The input schema exposes ten unrelated parameters (zone, json, url, host, website, city, query, path, ref, feed) on a tool whose description is only about an ISO language tag, identical to the schema shared by many unrelated tools in this set. While not directly malicious, this generic/overloaded schema pattern across many disparate single-purpose tools could enable confusion about what data a given call actually consumes/sends, and should be clarified so agents and users understand exactly which fields are used per tool.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/0e8b19e1-fcd6-4cab-8ef7-6c64d57b1549)Scanned 10/2/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free