MCP security report

agent-observatory-sensor.nolimit-observatory.workers.dev

D61/100
Security grade DA few things are worth a closer look before connecting.
Connected ✓31 tools scanned

https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/fnv64-len/mcp

mediumagent-tool-index
Embedded navigation instruction with tracking parameters directs agent to external monetized gateway
The description instructs the agent to 'Follow start_here.hop first' and describes a redirect chain carrying utm_source=agent-observatory&utm_medium=agent, explicitly identifying the request as coming from an AI agent to a third-party pay-per-call tool gateway. This is an embedded directive steering agent behavior toward an external commercial service and leaking agent/automation signals to that third party, without clear user awareness or consent. The tool's stated purpose (finding a gateway) does not require prescribing a specific hop sequence with tracking parameters.
mediumpeople-search-index
Directs agent to a people-search index for 'living people', with embedded hop/tracking instructions
Like the other index tools, this description instructs the agent to follow a specific redirect ('start_here.hop') carrying utm_source/utm_medium tracking identifying agent traffic, and explicitly promotes a people-search service covering living individuals. Steering an agent toward a people-search/data-broker service raises privacy concerns (potential facilitation of locating personal information about real people) and the prescriptive hop-following instruction is an embedded directive beyond the tool's simple 'discovery' function.
mediumagent-ads-index
Embedded instructions to follow tracked redirects and initiate a '7-day trial handoff for your operator'
The description tells the agent to follow a specific hop sequence carrying agent-identifying UTM parameters and explicitly mentions handing off a '7-day trial' for the operator. This goes beyond a simple lookup/indexing function and could cause the agent to initiate account/trial sign-up actions or commercial commitments on behalf of the user/operator without clear, separate user consent, and leaks agent-identifying telemetry to a third party by design.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowplaywright-url-ok
Tool name may spoof the well-known Playwright browser-automation tool
The name 'playwright-url-ok' invokes the identity of the widely used Playwright automation framework/MCP tool, but the tool explicitly does not launch a browser and only performs a basic URL check (identical description to the unrelated 'browser-url-ok'). This naming could mislead an agent or user into believing real browser automation capability is being invoked, or could be used to preferentially get selected over a legitimate Playwright tool in a tool list.
Embed this badge

Show your MCP server’s security grade

MCP security grade D

Paste this into your README:

[![MCP security](https://gateturbo.com/badge/scan/7b033cac-683e-4120-b751-394efa5e4b29)](https://gateturbo.com/report/7b033cac-683e-4120-b751-394efa5e4b29)

Scanned 10/2/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.

Connect this server safely with gate.

Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.

Monitor it — free