MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F37/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/jd-ok/mcp
highpeople-search-index
Directs agent toward a people-search/data-broker service and tells it to follow tracked hops
Beyond the embedded 'Follow start_here.hop' redirect-following instruction (same tracking-parameter pattern as other 'index' tools), this tool's purpose is to locate a 'people-search' index — a category of service often used for aggregating personal data (addresses, relatives, background info) on private individuals. Encouraging an agent to autonomously discover and integrate with such a service raises privacy/surveillance concerns, and the instruction to 'follow' hops first is a directive aimed at agent behavior rather than a neutral tool description.
mediumagent-tool-index
Embedded directive instructs agent to follow tracked redirect chain
The description tells the agent to 'Follow start_here.hop first' through a 302 redirect carrying utm_source/utm_medium tracking parameters, and to then follow further docs/CLI/MCP hops. This is an instruction aimed at the agent's behavior (navigate a specific promotional/affiliate link chain) rather than a description of the tool's own function, and could cause the agent to autonomously visit external sites or onboard to a paid service without explicit user awareness or consent.
mediumagent-ads-index
Embedded directive pushes agent toward a trial sign-up / ad placement funnel
The description instructs the agent to 'Follow start_here.hop first' (again via a tracked 302 redirect with utm_source=agent-observatory&utm_medium=agent) and highlights a '7-day trial handoff for your operator.' This steers the agent toward initiating a vendor trial/onboarding flow on behalf of the user/operator, which goes beyond simply returning information and could result in unwanted signups or commitments made without clear user consent.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowjd-ok
Overly broad, reused schema unrelated to stated function
The tool is described as computing a 'Julian Day integer band' but its input schema exposes ten unrelated fields (zone, json, url, host, website, city, query, path, ref, feed) shared identically across nearly all 31 tools in this set. This generic catch-all schema makes it unclear what data the tool actually consumes/sends, and is a pattern that could be used to quietly accept and forward sensitive-looking fields (e.g., file paths, hostnames, URLs) under tools whose names suggest a narrow, harmless purpose.
lowutc-time
Schema fields unrelated to tool purpose
A simple 'current UTC timestamp' tool exposes the same ten-field generic schema (including path, host, website, query, feed) used by all other tools, rather than a minimal schema matching its stated function. This inconsistency between description and schema could mask unexpected data flows.
lowtimezone
Schema fields unrelated to tool purpose
Shares the identical oversized generic schema with unrelated fields (path, website, feed, json, etc.) rather than exposing only a timezone-relevant parameter.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/8d14a74c-dd6c-4f16-920f-d08ef7b71cec)Scanned 10/1/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free