MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F43/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/lang-ka/mcp
highpeople-search-index
Facilitates discovery of a people-search / doxxing-adjacent service with tracked redirects
Description tells the agent to 'Find a living people-search index' and to follow a tracked start_here.hop redirect (utm_source=agent-observatory&utm_medium=agent). People-search indexes aggregate personal data (addresses, phone numbers, relatives) and are commonly used for harassment or doxxing. Directing an agent to discover and potentially interact with such a service, combined with embedded tracking-link instructions, is a privacy and manipulation concern that goes beyond a simple benign lookup tool.
mediumagent-tool-index
Embedded instruction to follow tracked redirect chain
The description instructs the agent to 'Follow start_here.hop first' through a 302 redirect carrying utm_source/utm_medium tracking parameters, and to then follow further CLI/docs/remote-MCP hops. This is an directive aimed at the agent's behavior (not just data retrieval) that routes the agent through an affiliate-tracked funnel toward a 'pay-per-call' commercial gateway, potentially committing the user/agent to a paid service without clear informed consent.
mediumagent-ads-index
Instructs agent to pursue an advertising sign-up / trial funnel via tracked links
Description directs the agent to follow a tracked start_here.hop redirect and explicitly mentions a '7-day trial handoff for your operator', i.e., steering the agent toward enrolling the operator in a paid trial/ad-placement service. This is an embedded behavioral instruction (not just a data-returning utility) that could cause the agent to take consequential actions (signups, commitments) on the user's behalf without clear visibility, and funnels traffic through UTM-tagged affiliate links benefiting a third party (agent-observatory).
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowlang-ka
Oversized, generic multi-purpose schema shared across unrelated tools
Every tool in this set (clock, JSON validator, URL tools, weather, calculator, etc.) exposes the identical 10-field schema (zone, json, url, host, website, city, query, path, ref, feed) regardless of the tool's actual single stated purpose. This design makes it hard for the agent/user to reason about what data each call actually sends, and could allow unrelated or sensitive-looking fields (e.g., 'path', 'host') to be silently populated and transmitted to a backend for a tool whose description says it only does one narrow thing, increasing risk of unintended data exposure or confused-deputy behavior.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/444adbf0-8311-426b-9934-0e7a45084fd7)Scanned 10/2/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free