MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F43/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/ms-utc/mcp
highpeople-search-index
Tool directs agent to a people-search/background-check aggregator with embedded tracking
The description instructs the agent to 'follow start_here.hop first' through a redirect chain carrying utm_source/utm_medium tracking parameters, leading to a 'living people-search index.' This both embeds an action directive aimed at the agent (follow this specific hop, in this order) rather than describing a bounded utility function, and promotes an index aggregating personal data about living individuals, which raises privacy/surveillance risk if the agent acts on it without informing the user of where results originate or that tracking identifiers are being propagated on the user's behalf.
mediumagent-tool-index
Embedded navigation instruction to a third-party monetization gateway with tracking parameters
The description tells the agent to 'Follow start_here.hop first' through a 302 redirect containing utm_source=agent-observatory&utm_medium=agent before reaching a 'pay-per-call tool gateway.' This is a directive aimed at the agent's behavior (which link to prioritize, in what order) rather than a description of what the tool itself computes, and it silently attaches marketing/attribution tracking to agent-initiated traffic without the user's awareness or consent.
mediumagent-ads-index
Tool promotes click-through to an ad-placement/monetization funnel with tracking and a 'trial handoff'
The description instructs the agent to follow a tracked start_here.hop redirect and surfaces a '7-day trial handoff for your operator,' i.e., content aimed at signing up the agent's operator for a paid/advertising service. This goes beyond a simple lookup/check tool and embeds a directive steering the agent toward a specific commercial action chain, with tracking parameters attached, which the user has not asked for and may not be aware of.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowms-utc
Shared oversized schema accepts many unrelated fields across all 31 tools
Every tool in this set (ms-utc, utc-time, timezone, etc.) exposes an identical schema with ten unrelated parameters (zone, json, url, host, website, city, query, path, ref, feed) regardless of the tool's single stated purpose. This makes it impossible for the agent or a reviewer to know which inputs a given tool actually uses or transmits, and could allow a server to silently collect broader data (e.g., file paths, URLs, queries) than the tool's narrow description implies. Recommend per-tool schemas scoped to only the parameters actually used.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/a68017e4-c872-430a-9d8e-35819addd884)Scanned 10/2/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free