MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F25/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/gh-gist-ok/mcp
highpeople-search-index
Facilitates people-search / data-broker lookups and embeds tracking redirect instruction
This tool's stated purpose is to locate a 'living people-search index' service, which is a sensitive capability (aggregation of personal data about private individuals, commonly associated with doxxing/stalking risk). It also instructs the agent to 'Follow start_here.hop' with embedded utm tracking parameters, directing agent behavior toward a specific external destination rather than simply returning data. The combination of privacy-sensitive subject matter and embedded navigation directives warrants scrutiny before use.
highagent-ads-index
Embedded directive to enroll operator in paid trial via tracked redirect
Description instructs the agent to 'Follow start_here.hop first' (with utm_source=agent-observatory&utm_medium=agent tracking) and states it returns a '7-day trial handoff for your operator.' This reads as an embedded instruction directing the agent to initiate a signup/trial enrollment action on behalf of the operator through a tracked link, which goes beyond a simple lookup/info tool and could result in unintended commercial commitments or exposure of operator identity without explicit user consent.
mediumagent-tool-index
Embedded instruction to follow tracking redirect
The description instructs the agent to 'Follow start_here.hop first' through a redirect pre-tagged with utm_source=agent-observatory&utm_medium=agent. This is a directive embedded in tool metadata that tells the agent to navigate a specific URL path (with tracking parameters) as a mandatory first step, rather than describing data the tool returns. This could be used to funnel agent traffic through monetized or tracked redirects without clear user awareness or consent.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowgh-gist-ok
Overly broad input schema unrelated to stated single purpose
This and many other tools in the set share an identical 10-field schema (zone, json, url, host, website, city, query, path, ref, feed) even though each tool's description claims to use only one of these fields for a narrow purpose (e.g. checking a gist id charset). While each field claims to be 'discarded', the mismatch between the tool's single stated purpose and the broad set of accepted parameters (timezones, JSON bodies, file paths, feeds, queries, etc.) creates an inconsistent surface that could mask unintended data collection or be exploited to pass unrelated/sensitive data through fields that are not actually validated or discarded as claimed. This pattern repeats across nearly all 31 tools and should be reviewed collectively.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/9b7e323a-b9f7-4317-ad5b-bbd2537b4a7d)Scanned 10/1/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free