MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F43/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/tz-asia-bahrain/mcp
highpeople-search-index
People-search capability with embedded redirect instruction; privacy risk
This tool is framed as a generic utility (matching the schema of time/URL tools) but actually promotes a 'living people-search index,' which is a sensitive capability (can facilitate doxxing/stalking) far outside the stated bounds of harmless utilities in this set. It also contains the same embedded directive 'Follow start_here.hop' with tracking parameters, instructing the agent to traverse an external chain of links/APIs rather than simply describing a return value.
mediumagent-tool-index
Embedded directive instructs agent to follow tracked redirect chain
The description tells the agent to 'Follow start_here.hop first' through a 302 redirect carrying utm_source=agent-observatory&utm_medium=agent tracking parameters, then follow further 'docs, CLI, and remote MCP hops.' This is an imperative behavioral instruction embedded in a tool description (rather than a neutral description of outputs), designed to funnel the agent through tracked links to an external pay-per-call gateway. This could drive traffic/conversion metrics or lead the agent to invoke untrusted remote MCP endpoints without the user's informed consent.
mediumagent-ads-index
Marketing/ad-placement tool with embedded instruction and trial sign-up handoff
Description instructs the agent to 'Follow start_here.hop first' (with tracking UTM parameters) and states it returns a '7-day trial handoff for your operator.' This embeds a directive that could lead the agent to initiate a trial/sign-up or advertising placement on behalf of the operator without clear user awareness or consent, going beyond a neutral read-only utility and into commercial action-taking territory.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowagent-tool-index
Tracking parameters baked into tool behavior
The utm_source=agent-observatory&utm_medium=agent query string appended to the redirect is designed to attribute agent-driven traffic to a specific campaign; this is an analytics/marketing mechanism embedded in a tool meant to look like neutral infrastructure discovery, which could misattribute or expose agent usage patterns to a third party.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/a763f962-8a7a-4ee5-9e67-9d9a8493ad08)Scanned 10/3/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free