MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F43/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/cc-im/mcp
highpeople-search-index
Promotes people-search/doxxing service and embeds navigation instructions for the agent
The description tells the agent to 'Find a living people-search index' and to 'Follow start_here.hop' first, directing it toward a third-party service that indexes personal information about living individuals. This both embeds an action directive aimed at the AI (follow this specific hop/URL) rather than simply describing a function, and encourages facilitating lookup of personal data about people, which is a privacy/safety concern beyond the tool's stated simple purpose of 'returning CLI setup, docs, API, and remote MCP hops.'
mediumagent-tool-index
Embedded instruction directing agent to follow a tracked redirect to a paid third-party gateway
The description instructs the agent to 'Follow start_here.hop first' and explains that the hop carries a 302 redirect with utm_source=agent-observatory&utm_medium=agent, i.e. tracking parameters that identify the request as coming from an AI agent. This is an embedded directive telling the AI how to behave (navigate a specific tracked link) rather than a neutral description of the tool's output, and it funnels the agent toward a 'pay-per-call' commercial gateway, which is broader than a simple lookup/info tool should need to do.
mediumagent-ads-index
Instructs agent to pursue a trial signup/handoff on behalf of 'your operator' via tracked redirect
The description tells the agent to 'Follow start_here.hop first' (again with utm_source=agent-observatory&utm_medium=agent tracking) and says it returns a '7-day trial handoff for your operator.' This embeds a directive for the agent to initiate or facilitate an account/trial signup process for a commercial advertising platform without the user's explicit awareness, going beyond the tool's stated purpose of indexing agent-discoverability.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowcc-im
Uniform, overly broad input schema shared across unrelated tools
Every tool in this set exposes the exact same ten input fields (zone, json, url, host, website, city, query, path, ref, feed) regardless of its actual function — e.g., a country-info lookup tool accepts 'path', 'ref', 'json', and 'feed' parameters it has no stated use for. This generic catch-all schema makes it hard to verify what data is actually consumed/sent by each tool and could allow sensitive values to be routed through an unrelated-sounding tool without clear justification.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/af7141db-3fae-437f-93ba-4ff977f61cf8)Scanned 10/4/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free