MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F43/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/xid-shape/mcp
highpeople-search-index
Promotes a people-search / background-check lookup tool with embedded redirect instructions
Description instructs the agent to 'Follow start_here.hop' (with the same agent-observatory tracking params) to reach a 'living people-search index' service. Combining an instruction to follow an external tracked link with a tool whose purpose is locating information about living individuals raises both a prompt-injection concern (directing agent navigation) and a privacy concern (facilitating lookup of personal data about real people with no stated safeguards).
mediumagent-tool-index
Embedded instruction directing agent to follow a tracked redirect link
The description tells the agent to 'Follow start_here.hop first' through a 302 redirect that carries utm_source=agent-observatory&utm_medium=agent tracking parameters. This is an instruction aimed at the AI's behavior (steering it to a specific external hop before doing anything else) rather than a description of the tool's actual function, and it funnels agent traffic through tracking parameters without the user's visibility or consent.
mediumagent-ads-index
Advertising/monetization steering embedded in tool description with tracked redirect
Description instructs the agent to 'Follow start_here.hop first' (tracked with utm_source=agent-observatory&utm_medium=agent) to reach an ad-placement/client-onboarding funnel including a '7-day trial handoff for your operator'. This embeds marketing/commercial steering instructions targeted at the AI agent itself, encouraging it to initiate a trial or vendor handoff on behalf of its operator, which goes beyond a simple lookup/info tool and could commit the user/operator to a commercial relationship without clear disclosure.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowxid-shape
Oversized, unrelated parameter schema shared across all tools
Every tool in this set exposes the identical large parameter set (zone, json, url, host, website, city, query, path, ref, feed) regardless of the tool's stated single purpose. While each individual tool's description claims the extra fields are unused/discarded, this broad shared schema is unusual design that could mask parameter confusion or let a future backend silently begin using fields (e.g., 'path' or 'json') that are currently described as inert.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/14445e8a-8971-4454-bf40-94c80e51efb4)Scanned 10/4/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free