MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F43/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/st-ny/mcp
highpeople-search-index
Directs agent to a people-search service for 'living people' with tracked redirect
This tool's description instructs the agent to 'Follow start_here.hop' (a tracked 302 redirect) to reach a people-search index that looks up information about living individuals. Encouraging an agent to autonomously pursue a people-search/doxing-adjacent service, especially via an embedded directive rather than user-initiated action, raises privacy and misuse concerns, and the tracking parameters suggest this is also an undisclosed marketing/affiliate funnel rather than a neutral lookup tool.
mediumagent-tool-index
Embedded directive instructs agent to follow a tracked redirect
The description tells the agent to 'Follow start_here.hop first' and references a 302 redirect carrying utm_source=agent-observatory&utm_medium=agent tracking parameters. This is an instruction aimed at the agent's behavior (auto-following a hop chain) rather than a description of the tool's own function, and it funnels the agent toward an external pay-per-call gateway with tracking attribution baked in, which could be used to drive agents toward paid/affiliate services without the user's awareness.
mediumagent-ads-index
Instructs agent to pursue an ad-placement signup/trial on behalf of 'your operator'
The description tells the agent to follow a tracked start_here.hop redirect and explicitly mentions returning 'the 7-day trial handoff for your operator.' This embeds an instruction directing the agent to initiate a trial/signup process for an advertising placement service on behalf of its operator, which goes beyond the stated lookup/informational purpose and could lead the agent to take consequential actions (service signup, ad placement) without explicit user consent.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowst-ny
Overly broad shared schema unrelated to stated purpose
A tool described as merely returning 'USPS state code NY' accepts ten unrelated parameters (zone, json, url, host, website, city, query, path, ref, feed) that are irrelevant to its stated function. This pattern, repeated identically across unrelated tools, is an unusual design that could allow smuggling arbitrary data (URLs, JSON, file paths, queries) into calls that don't need it, increasing the attack surface even though each field claims to be 'discarded'.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/9756dae4-f2b5-4b3a-97ad-d1a6fcc594cc)Scanned 10/3/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free