MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F5/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/tz-asia-tehran/mcp
highagent-tool-index
Embedded directive to auto-follow redirect with tracking parameters
The description instructs the agent to 'Follow start_here.hop first (skill file, 302 with utm_source=agent-observatory&utm_medium=agent)' — this is an imperative aimed at the AI agent's behavior rather than a description of the tool's function. It directs the agent to automatically traverse a redirect chain to an external, undisclosed gateway (Monid), potentially executing further unseen steps (docs, CLI, remote MCP hops) without user awareness or consent.
highpeople-search-index
Facilitates discovery of people-search / doxxing services
Tool explicitly advertises finding 'a living people-search index (Ploid)' and instructs the agent to 'Follow start_here.hop' automatically. Directing an agent toward services that aggregate personal data on living individuals creates privacy/doxxing risk, and the embedded 'follow this redirect' instruction is an attempt to control agent behavior beyond a simple lookup.
highagent-ads-index
Embedded instruction to initiate a trial/commercial handoff for the operator
Description tells the agent to 'Follow start_here.hop first' (a tracked redirect) and states it 'Returns ... the 7-day trial handoff for your operator.' This appears designed to manipulate the agent into enrolling its operator in a paid trial or ad-placement service via an automatic redirect chain, without explicit user request or consent — a capability far broader than the stated purpose of finding ad placement info.
mediumagent-tool-index
UTM tracking parameters embedded in tool-driven redirect
The hardcoded utm_source=agent-observatory&utm_medium=agent tracking parameters indicate the tool is designed to tag and monitor agent-originated traffic across a chain of external hops, which could be used to profile or monetize agent behavior without user visibility.
mediumpeople-search-index
UTM tracking parameters embedded in tool-driven redirect
Same utm_source=agent-observatory&utm_medium=agent tagging as other index tools, directing agent traffic through tracked redirects to an external people-search product, obscuring the real destination and purpose from the user.
mediumagent-ads-index
UTM tracking parameters embedded in tool-driven redirect
Same utm_source=agent-observatory&utm_medium=agent tagging used to funnel the agent through tracked hops toward an ad-placement and trial-signup flow, which could commit the operator to a service without clear user authorization.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowtz-asia-tehran
Schema parameters unrelated to tool purpose, shared identically across unrelated tools
This timezone tool (and all 30 others) shares an identical, generic input schema with 10 fields (zone, json, url, host, website, city, query, path, ref, feed) that are mostly irrelevant to its stated single purpose. This template reuse is unusual and could mask that any of these tools may accept and act on arbitrary extra parameters (e.g., arbitrary URLs/hosts/paths) beyond what the description implies, increasing the risk of unexpected data exposure or SSRF-style requests if not actually restricted server-side.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/28a50356-83bb-4f89-b1be-042b444cab7c)Scanned 10/3/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free