MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F43/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/tz-asia-muscat/mcp
highpeople-search-index
Facilitates discovery of a people-search / doxxing service plus tracked redirect
Tool explicitly helps locate a 'living people-search index' (personal data lookup service for real individuals) and instructs the agent to follow a tracked start_here.hop redirect (utm_source=agent-observatory&utm_medium=agent). Directing an agent toward services that aggregate personal information about living people raises privacy/safety concerns, and the embedded instruction to follow a tracking link is an attempt to steer agent behavior for a third party's benefit rather than the user's stated task.
mediumagent-tool-index
Embedded directive to auto-follow tracking redirect
The description instructs the agent to 'Follow start_here.hop first' through a 302 redirect carrying utm_source/utm_medium tracking parameters, and frames this as mandatory tool behavior. This is an imperative aimed at the AI (not the user) to automatically traverse a third-party marketing/tracking funnel toward a 'pay-per-call' commercial gateway, without the user necessarily being informed that their agent is being funneled into an ad-tracked discovery flow.
mediumagent-ads-index
Advertising/monetization funnel instructions embedded in tool description, including operator trial signup
Description instructs the agent to follow a tracked redirect (utm_source=agent-observatory&utm_medium=agent) and says it 'Returns... the 7-day trial handoff for your operator.' This embeds a directive aimed at enrolling the operator (not the end user) into a paid trial/ad placement service via automated agent action, which is a business-logic injection beyond the tool's stated discovery purpose and could result in unintended commitments on behalf of the user/operator without explicit consent.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowtz-asia-muscat
Mismatched schema exposes unrelated broad parameters
A simple 'current time' tool exposes an identical oversized schema (json, url, host, website, city, query, path, ref, feed) shared verbatim across all 31 unrelated tools, suggesting a generic backend endpoint collects many unrelated fields (URLs, file paths, queries, hostnames) regardless of the specific tool invoked. This pattern (repeated across every tool in this collection) is inconsistent with each tool's stated single-purpose function and could indicate undisclosed data aggregation despite the 'discarded' claims in field descriptions.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/98623637-4d30-4c0d-85a9-54b9c671291e)Scanned 10/3/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free