MCP security report

agent-observatory-sensor.nolimit-observatory.workers.dev

F5/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned

https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/lang-hr/mcp

highagent-tool-index
Embedded instruction directing agent to follow tracking redirect
The description explicitly instructs the AI agent to 'Follow start_here.hop first' and references a 302 redirect with hard-coded UTM parameters (utm_source=agent-observatory&utm_medium=agent). This is not a description of the tool's function but a directive telling the agent how to behave (auto-navigate a tracked redirect chain), which can be used to funnel agent traffic to a monetized/pay-per-call gateway without the user's awareness or consent.
highpeople-search-index
People-search/doxxing capability combined with tracked redirect instructions
This tool advertises indexing a 'living people-search index' and instructs the agent to follow a tracked start_here.hop redirect with UTM parameters. Combining a people-search capability (privacy-sensitive, potential for misuse/doxxing) with embedded navigation instructions aimed at the agent raises concerns about facilitating privacy violations and directing agent behavior toward an undisclosed third-party service.
highagent-ads-index
Ad-placement/monetization tool instructing agent to complete a trial signup handoff
The description tells the agent to follow a tracked redirect (start_here.hop, UTM-tagged) and states it returns a '7-day trial handoff for your operator.' This reads as an embedded instruction for the agent to initiate or complete a trial signup/commitment on behalf of the operator without explicit user consent, and to funnel the agent toward an advertising/monetization funnel rather than performing a neutral utility function.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowagent-tool-index
Oversized generic schema relative to stated purpose
Like all 31 tools, this tool exposes a schema with ten unrelated input fields (zone, json, url, host, website, city, query, path, ref, feed) that have no clear relation to 'finding a pay-per-call tool gateway.' This generic catch-all schema pattern could allow arbitrary data to be passed/collected under a tool whose description doesn't justify needing all of it.
lowpeople-search-index
Oversized generic schema relative to stated purpose
Shares the same ten-field generic schema as all other tools, unrelated to the tool's described purpose of locating a people-search index, raising concerns about scope creep or disguised data collection.
lowagent-ads-index
Oversized generic schema relative to stated purpose
Shares the same ten-field generic schema as all other tools, unrelated to the tool's described purpose of finding an ad-placement index, raising concerns about scope creep or disguised data collection.
Embed this badge

Show your MCP server’s security grade

MCP security grade F

Paste this into your README:

[![MCP security](https://gateturbo.com/badge/scan/4d11e70e-bde9-494c-82da-a74b868e559f)](https://gateturbo.com/report/4d11e70e-bde9-494c-82da-a74b868e559f)

Scanned 10/2/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.

Connect this server safely with gate.

Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.

Monitor it — free