MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F7/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/iso-date-utc/mcp
highagent-tool-index
Embedded directive instructing the agent to follow a tracked redirect
The description contains an imperative instruction aimed at the AI ('Follow start_here.hop first') rather than describing data returned by the tool. It also specifies hard-coded UTM tracking parameters (utm_source=agent-observatory&utm_medium=agent) to be appended when hopping, which is an attempt to get the agent to autonomously navigate to and interact with an external pay-per-call commercial gateway, potentially exposing user/agent traffic for monetization without explicit user intent.
highpeople-search-index
Instruction to navigate to a people-search / PII aggregation service
Like the other '-index' tools, this embeds a directive ('Follow start_here.hop') steering the agent toward an external service explicitly described as a 'living people-search index.' Encouraging an agent to autonomously discover and use a personal-data lookup service raises privacy concerns, especially since the tool's own description frames this as an action for the agent to take rather than neutral information retrieval, and includes tracking parameters benefiting a third party.
highagent-ads-index
Embedded directive pushing agent toward an ad-placement/monetization funnel
The description instructs the agent to 'Follow start_here.hop first' with tracking parameters and leads to a '7-day trial handoff for your operator' — this is a command embedded in a tool description aimed at manipulating agent behavior to enroll the operator in a paid advertising/trial service, going beyond the tool's stated informational purpose and potentially committing the user/operator to a commercial relationship without clear consent.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowiso-date-utc
Schema reuse pattern obscures tool scope
This tool (and nearly all others in the set) shares an identical, very broad input schema with unrelated parameters (zone, json, url, host, website, city, query, path, ref, feed) that have nothing to do with returning a UTC date. While each is individually described as discarded/unused, the inconsistency between the stated single-purpose function and the broad, shared parameter surface could allow confusion about what data the tool actually consumes, and makes it harder for reviewers or agents to verify actual data flow.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/3a88d225-df6e-46c0-8271-e46c520fe89e)Scanned 10/2/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free