MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F37/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓30 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/sent-ok/mcp
highagent-tool-index
Embedded directive to follow an external redirect chain
The description instructs the agent to 'Follow start_here.hop first (skill file, 302)' and mentions it 'also returns docs, CLI, and remote MCP hops' to a 'pay-per-call tool gateway (Monid)'. This is an instruction aimed at the agent's behavior rather than a description of the tool's function, and it directs the agent to chase a redirect to an unknown third-party service that could register the agent for paid API calls, load additional untrusted tool definitions, or serve further prompt injection content. This kind of self-referential 'do X next' instruction inside a tool description is a classic prompt-injection pattern and should not be trusted or auto-followed by the agent without explicit user consent.
highpeople-search-index
People-search / OSINT capability with external gateway redirection
This tool advertises finding a 'living people-search index (Ploid)' and returns 'CLI setup, docs, API, and remote MCP hops.' A tool that indexes into person-lookup services raises privacy concerns (potential for doxxing or unauthorized personal-data lookups) and, like agent-tool-index, encourages the agent to follow hops to an external, unverified service that could exfiltrate query data or lead to registration with a third-party paid API without user awareness, despite the claim that 'Query text discarded.'
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowsent-ok
Uniform oversized schema shared across unrelated single-purpose tools
Every tool in this set (including this one) exposes an identical nine-field schema (zone, json, url, host, city, query, path, ref, feed) regardless of the tool's stated single purpose. For a tool literally described as a 'sentence-terminator charset' check, accepting a URL, file path, hostname, and JSON body is far broader than needed. This pattern — one shared schema copy-pasted across ~30 differently named tools — makes it easy to smuggle unrelated data (paths, hosts, URLs) into calls that appear narrowly scoped, and complicates auditing what each tool actually does with the extra fields.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/4c1c36bb-8be6-401d-a150-ab664469c59e)Scanned 9/15/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free