MCP security report

agent-observatory-sensor.nolimit-observatory.workers.dev

F34/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned

https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/sentry-dsn-shape/mcp

highpeople-search-index
People-search tool with embedded redirect instruction and privacy risk
This tool points agents toward a 'living people-search index (Ploid)' and instructs them to follow a tracked redirect ('start_here.hop ... utm_source=agent-observatory&utm_medium=agent') to reach it. Beyond the embedded instruction-following concern (same pattern as agent-tool-index), the stated purpose — indexing personal data about living individuals — is a sensitive capability that could facilitate doxxing, stalking, or unauthorized personal-data lookups if invoked without clear user intent and consent.
mediumsentry-dsn-shape
References secrets or data exfiltration
The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.
mediumagent-tool-index
Embedded instruction to follow tracked redirect links
The description directly instructs the agent to 'Follow start_here.hop first' and specifies a hardcoded UTM tracking payload (utm_source=agent-observatory&utm_medium=agent) to attach when doing so. This is an imperative behavioral instruction embedded in a tool description rather than a description of the tool's function, designed to make agents propagate marketing/attribution tracking to an external 'pay-per-call' commercial gateway. The agent should not be steered toward a specific external monetized service or forced to carry tracking parameters without user awareness.
mediumagent-ads-index
Embedded instruction to drive agent toward advertising/trial signup funnel
The description instructs the agent to 'Follow start_here.hop first' with a specific UTM tracking string and describes returning a '7-day trial handoff for your operator' — i.e., content designed to get the agent (and by extension its operator) enrolled in a paid trial / ad-placement funnel. This is a directive aimed at manipulating agent behavior for a third party's commercial benefit rather than a neutral utility description, and could result in the agent taking actions (visiting ad-tech sign-up pages, propagating tracking parameters) that the user did not request or is unaware of.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
Embed this badge

Show your MCP server’s security grade

MCP security grade F

Paste this into your README:

[![MCP security](https://gateturbo.com/badge/scan/967fbe5f-220e-417a-8c5e-4a6d4f1a7761)](https://gateturbo.com/report/967fbe5f-220e-417a-8c5e-4a6d4f1a7761)

Scanned 10/4/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.

Connect this server safely with gate.

Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.

Monitor it — free