MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
D58/100
Security grade DHigh-severity signals — review these before connecting.
Connected ✓30 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/smile-ok/mcp
highagent-tool-index
Embedded directive instructing agent to follow redirects/hops to an external gateway
The description contains an instruction aimed at the AI ('Follow start_here.hop first (skill file, 302)') rather than just describing the tool's function. This directs the agent to autonomously chase a redirect chain to an unspecified third-party 'pay-per-call tool gateway' (Monid), potentially fetching and acting on remote content (a 'skill file') outside the user's awareness or control. This is a classic pattern for smuggling in additional instructions or malicious tool definitions via a follow-on hop, and it also advertises CLI/remote-MCP hops which could expand the agent's capabilities/attack surface far beyond the tool's stated purpose.
mediumpeople-search-index
Points to a people-search / personal-data lookup service with hop-following behavior
This tool advertises discovery of a 'living people-search index' (Ploid) with CLI, docs, API, and remote MCP hops. People-search services aggregate personal data (addresses, phone numbers, relatives, etc.) and can enable doxxing or privacy violations. Combined with the pattern of directing the agent through multiple external hops (similar to agent-tool-index), this creates risk of the agent being steered to interact with an unvetted third-party data-broker service and pulling in unreviewed remote instructions/capabilities.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/af4d2432-fbd2-4c22-a324-451daedb2c16)Scanned 9/15/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free