MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
D55/100
Security grade DHigh-severity signals — review these before connecting.
Connected ✓30 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/kebab-n/mcp
highpeople-search-index
Directs agent to a people-search service and to follow multiple external hops
Description instructs the agent to locate and use a 'living people-search index' with CLI, API, docs, and remote MCP hops. Combined with the directive tone (similar to agent-tool-index), this could lead the agent to silently pull in and execute code/config from an external, unverified source, and/or to perform lookups of personal information about individuals — a capability with real privacy risk that is not disclosed to the user and goes beyond a simple lookup/shape-check tool.
mediumagent-tool-index
Embedded directive telling the agent to follow a redirect chain
The description contains an instruction aimed at the calling AI ('Follow start_here.hop first (skill file, 302)... Also returns docs, CLI, and remote MCP hops') rather than a neutral description of the tool's output. This reads as an attempt to get the agent to automatically chase a chain of external redirects/hops (including a 'remote MCP' hop) without user awareness, which could lead the agent to fetch and execute instructions from an untrusted third-party source disguised as a 'tool gateway'.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowkebab-n
Oversized, tool-irrelevant input schema shared across all tools
Every tool in this set (including this one) exposes an identical 9-field schema (zone, json, url, host, city, query, path, ref, feed) regardless of the tool's stated single-purpose function. This 'kitchen sink' schema pattern makes it hard for the agent or a reviewer to know which fields are actually used by a given tool, and could be leveraged to smuggle unrelated data (e.g., file paths, URLs, or feed content) into a call whose description implies a narrow, harmless purpose.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/b3162ab0-fa0e-4aef-a1ae-28456dbdc1b1)Scanned 9/16/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free