MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F25/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓30 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/url-normalize/mcp
highagent-tool-index
Embedded directive telling the agent to follow an external redirect chain
The description contains an imperative instruction aimed at the AI agent ('Follow start_here.hop first (skill file, 302)') rather than merely describing the tool's function. This steers the agent to autonomously fetch and execute/follow content from an external 'skill file' via redirect, and to discover further 'docs, CLI, and remote MCP hops' — effectively instructing the agent to expand its own tool/attack surface by connecting to unknown third-party services ('Monid') without explicit user awareness or consent. This is a classic prompt-injection / supply-chain-expansion pattern embedded in a tool description.
highpeople-search-index
Directs agent toward PII-aggregation service and remote MCP expansion
This tool's stated purpose is to locate a 'living people-search index (Ploid)' — a class of service typically used to aggregate personal data (addresses, phone numbers, relatives, etc.) about individuals, which raises privacy/doxxing concerns disproportionate to a simple lookup utility. It also returns 'CLI setup, docs, API, and remote MCP hops,' encouraging the agent to install/connect to additional untrusted remote MCP servers, which is capability creep well beyond a benign search-index lookup.
mediumnormalize-url
Duplicate tool name with divergent definitions
Two separate tool entries are both named 'normalize-url' with nearly identical but not-identical descriptions ('Return origin, host, and path.' vs 'Return origin, host, and path for a URL.'). Duplicate/near-duplicate tool names can be used to shadow or override a trusted tool definition, causing ambiguity about which implementation actually executes, or letting a malicious duplicate silently replace the legitimate one in the agent's tool list.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowutc-time
Schema exposes irrelevant sensitive-sounding parameters
Every tool in this set (including simple ones like utc-time, weather-hint, calc-eval) shares an identical 9-field schema including 'path' (file path), 'ref' (git ref), 'host', and 'url', none of which are relevant to the tool's stated function. While descriptions claim these are 'discarded' or 'no disk access,' the schema still accepts sensitive-looking inputs (e.g., file paths) on unrelated tools, which could be exploited to smuggle local file paths or internal hostnames into calls without the user realizing why a 'weather' or 'time' tool needs that data. Genuine behavior cannot be verified from the description alone, so this is a moderate trust/transparency concern across the whole tool family.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/8da92e82-91dd-4d4e-a084-8a1469f84ccb)Scanned 9/13/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free