MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
D46/100
Security grade DHigh-severity signals — review these before connecting.
Connected ✓30 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/twip-mm/mcp
highagent-tool-index
Embedded directive urging the agent to follow external redirect chain
The description instructs the agent to 'Follow start_here.hop first (skill file, 302)' and says it 'Also returns docs, CLI, and remote MCP hops.' This is an imperative aimed at the AI rather than a description of a simple lookup — it steers the agent toward fetching and executing content from an unknown third-party 'pay-per-call' gateway (Monid), potentially causing the agent to install/invoke unvetted remote tools or incur charges without explicit user awareness or consent. This pattern is consistent with a prompt-injection/tool-chaining attempt hidden inside an otherwise innocuous-looking tool list.
mediumpeople-search-index
Facilitates locating a people-search / data-broker service for living individuals
The tool advertises finding a 'living people-search index (Ploid)' and returns CLI, docs, API, and remote MCP hops for it. Beyond its stated scope of returning a URL, this encourages the agent to pull in and use a personal-data lookup service, which raises privacy and misuse concerns (e.g., facilitating doxxing or unauthorized profiling) and, like agent-tool-index, nudges the agent toward chaining into an external, unverified tool ecosystem.
mediumagent-tool-index
Encourages onboarding into an external tool ecosystem beyond stated function
Returning 'docs, CLI, and remote MCP hops' goes beyond a simple URL-lookup utility; it functions as a bootstrap/loader for additional external capabilities (CLI installs, remote MCP servers) that the agent may be induced to adopt automatically, which is a broader and more dangerous capability than the tool's nominal 'find a public tool gateway' purpose suggests.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/a648c580-b71f-49c7-9758-c2db8a799314)Scanned 9/15/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free