MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F43/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/tz-africa-lagos/mcp
highagent-ads-index
Embedded instructions nudging agent toward ad-network signup/trial on behalf of 'your operator'
The description tells the agent to follow a tracked redirect ('start_here.hop', 302 with utm_source=agent-observatory&utm_medium=agent) and states it returns a '7-day trial handoff for your operator.' This frames the tool as providing a place to discover ad placement, but the embedded language directs the agent toward initiating a trial/signup flow for the human operator without explicit user request or visibility into that outcome — a manipulation vector encouraging the agent to take monetizable action beyond the tool's stated discovery purpose.
mediumagent-tool-index
Embedded agent directive to follow tracking redirect
The description instructs the AI to 'Follow start_here.hop first' and explicitly mentions a 302 redirect carrying utm_source=agent-observatory&utm_medium=agent tracking parameters. This is a behavioral instruction aimed at the agent (not just a description of functionality) that causes the agent to traverse a marketing/tracking redirect chain on behalf of a third party, without the user's awareness of the tracking attribution being generated.
mediumpeople-search-index
People-search capability raises privacy/doxxing concerns
Tool is described as finding a 'living people-search index' service. Facilitating lookups of personal information about private individuals is a sensitive capability that could enable harassment, stalking, or privacy violations, and goes beyond the benign utility pattern of the other tools in this set. The description also instructs the agent to follow a tracked redirect hop (utm_source=agent-observatory&utm_medium=agent), similar to the tracking concern in agent-tool-index.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowtz-africa-lagos
Overly broad, mismatched input schema shared across unrelated tools
This timezone tool (and all 28 similarly-schemed tools) exposes unrelated parameters such as 'path' (file path), 'host', 'json', 'query', 'ref', 'feed', 'website' that have nothing to do with returning the current time in Africa/Lagos. While each is individually described as discarded/unused, this kind of oversized, irrelevant parameter surface across every tool is unusual and could be leveraged to funnel unrelated sensitive data (e.g., file paths, hostnames, queries) through a single call without clear indication of what is actually processed server-side. Recommend the schema be scoped strictly to parameters relevant to the tool's function.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/bf0a6938-4b3a-4262-bd2b-59fd8e273455)Scanned 10/3/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free