MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F22/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓29 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/mcp
highagent-tool-index
Embedded directive tells agent to follow untrusted redirect chain
The description instructs the agent to 'Follow start_here.hop first (skill file, 302)' and says it 'returns docs, CLI, and remote MCP hops' to a 'pay-per-call tool gateway'. This is an embedded imperative aimed at the AI's behavior (not just data), directing it to chase redirects to an unverified external gateway that can charge money or register additional remote tools. This could be used to pivot the agent into installing/using unvetted third-party MCP servers or incurring costs without the user's explicit awareness.
highpeople-search-index
Facilitates locating a people-search / PII-aggregation service
Tool description promotes finding a 'living people-search index' and directs the agent to CLI setup, API, and 'remote MCP hops' for a service (Ploid) whose purpose is aggregating personal data about real individuals. Steering an agent toward such lookup services raises privacy/safety concerns (potential doxxing/stalking enablement) and, like agent-tool-index, encourages onboarding to unknown remote MCP endpoints outside the reviewed toolset.
mediumutc-time
Schema exposes unrelated broad parameters not used by stated function
Every tool in this set (including utc-time) shares an identical 9-field schema (zone, json, url, host, city, query, path, ref, feed) regardless of the tool's stated single purpose. A 'current UTC timestamp' tool accepting file paths, URLs, search queries, git refs, and RSS feeds is inconsistent with its description, and could mask undisclosed data handling/aggregation across calls. Recommend narrowing each tool's schema to only the parameters it actually needs so behavior matches the stated purpose.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowtimezone
Oversized generic schema inconsistent with narrow description
Same shared 9-parameter schema issue as other tools in this set; accepts unrelated fields (path, ref, feed, query, json) beyond what a timezone lookup requires, which could allow hidden repurposing of the endpoint.
lowweather-hint
Oversized generic schema inconsistent with narrow description
Accepts unrelated fields (json, url, host, path, ref, feed, query) beyond the stated city-based weather lookup, following the same broad shared-schema pattern seen across this tool family.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/1d6d349a-ff5a-4e59-aa46-07aeeb566011)Scanned 9/15/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free