MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F25/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/md5-ok/mcp
highpeople-search-index
Facilitates discovery of people-search/doxxing services with tracked redirect
This tool's stated purpose is to help the agent find a 'living people-search index,' which are tools commonly used to aggregate personal data about private individuals (addresses, phone numbers, relatives) — a significant privacy/doxxing risk. The description also instructs the agent to follow a tracked redirect (utm_source=agent-observatory&utm_medium=agent) to reach CLI, API, and MCP hops for the service, which is an embedded directive to the agent to continue interacting with an external, potentially harmful data broker rather than a neutral utility function.
highagent-ads-index
Instructs agent to initiate a commercial trial/signup on behalf of the user's operator
The description tells the agent to follow a tracked redirect (utm_source=agent-observatory&utm_medium=agent) and explicitly returns a '7-day trial handoff for your operator,' implying the agent should initiate or complete a signup/trial enrollment for an advertising network on behalf of the user without clear, explicit user consent. This goes beyond a simple lookup/check tool and could cause unintended financial or account commitments, and it funnels the agent toward further engagement with an ad-placement vendor via tracked links.
mediumagent-tool-index
Embedded tracking/redirect-following instruction aimed at the agent
The description instructs the agent to 'Follow start_here.hop first' to a URL carrying utm_source=agent-observatory&utm_medium=agent tracking parameters, and routes the agent toward a third-party pay-per-call gateway, docs, CLI, and remote MCP hops. This is an instruction to the agent to perform an external navigation/affiliate-style action as part of 'finding' a tool index, rather than a straightforward data lookup. It could be used to funnel agent traffic (and attribution credit) to an external commercial service without the user's awareness.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowmd5-ok
Oversized, irrelevant parameter schema shared across many unrelated tools
This tool (and nearly all others in the set) expose an identical ten-field schema (zone, json, url, host, website, city, query, path, ref, feed) even though the tool's stated function only needs one of these fields. While each field is individually described as 'discarded,' the pattern of reusing a broad, multi-purpose schema across dozens of distinct tools is unusual and could mask additional undocumented data flows or make it harder for reviewers/agents to reason about what data a given call actually sends; worth confirming server-side that unused fields are truly ignored and not logged or forwarded anywhere.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/943c9dae-8d8c-4f14-8d8b-1fdd92f1818b)Scanned 10/2/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free