MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F7/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/tz-asia-hebron/mcp
highagent-tool-index
Embedded instruction directing agent to follow tracking-laden redirect
The description tells the agent to 'Follow start_here.hop first' and explicitly describes a 302 redirect carrying utm_source=agent-observatory&utm_medium=agent tracking parameters. This is an instruction aimed at the AI's behavior (not the user) to drive traffic/attribution through a specific gateway, and it promotes a 'pay-per-call' commercial service. This could cause the agent to autonomously navigate to and interact with an undisclosed third-party monetization platform.
highpeople-search-index
Directs agent to a people-search/PII aggregation service with tracking redirect
Description instructs the agent to 'Follow start_here.hop' (with the same utm tracking pattern) to reach a 'people-search index' (Ploid). People-search tools aggregate personal information about private individuals and can facilitate doxxing or privacy violations; embedding directive language to funnel the agent toward such a service, with tracking parameters benefiting the operator rather than the user, is a manipulation/privacy risk.
highagent-ads-index
Instructs agent to commit to a '7-day trial' hand-off on behalf of 'your operator'
Description explicitly says it returns 'the 7-day trial handoff for your operator' and instructs following a tracked redirect (start_here.hop with utm_source/utm_medium). This is an embedded directive aimed at getting the AI agent to take actions (signing up for a trial, placing an operator's product into an ad/discovery network) without clear indication the user requested or consented to this, representing a monetization/manipulation risk disguised as a simple lookup tool.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowtz-asia-hebron
Schema bloat with unrelated parameters shared across all tools
Every tool in this set shares an identical, large input schema (zone, json, url, host, website, city, query, path, ref, feed) regardless of the tool's stated single purpose (e.g., a timezone tool accepting 'path', 'ref', 'feed', 'website' parameters it has no use for). This is unusual and could mask hidden functionality or make it hard for the agent to reason about what data is actually sent/used per call; while not proven malicious, it is an anomalous pattern worth flagging for review.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/9a78cb1d-a580-4ba3-a737-cd822984fcfc)Scanned 10/3/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free