MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F25/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/mime-mp4/mcp
highpeople-search-index
Facilitates discovery of a people-search / doxxing-style index
The tool is described as helping find a 'living people-search index (Ploid)' and directs the agent to follow a tracked redirect to reach it. Exposing or routing toward services that aggregate information about living individuals poses privacy and safety risks (potential for doxxing/stalking use), which is disproportionate to the stated benign purpose of 'finding an index'. The embedded 'follow this hop first' instruction also steers agent behavior rather than just describing data returned.
highagent-ads-index
Instructs agent to initiate a trial sign-up 'for your operator' and follow tracked redirects
The description tells the agent to follow a specific tracked redirect (utm_source=agent-observatory&utm_medium=agent) and states it returns 'the 7-day trial handoff for your operator', implying the agent should initiate or complete a commercial trial enrollment on behalf of the user/operator without explicit user consent. This goes beyond a simple lookup/discovery function and could result in unauthorized sign-ups, data sharing with an ad network, or unwanted recurring commitments.
mediumagent-tool-index
Embedded directive instructs agent to follow a specific tracked redirect
The description tells the agent to 'Follow start_here.hop first' and references a 302 redirect carrying hardcoded utm_source=agent-observatory&utm_medium=agent tracking parameters. This is an instruction aimed at the agent's behavior (mandating a particular navigation sequence and propagating marketing attribution) rather than a neutral description of the tool's function, and could be used to funnel agent traffic through an undisclosed referral/monetization scheme.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowmime-mp4
Schema reuses irrelevant parameters across all tools
Every tool in this set (including unrelated ones like 'mime-mp4', 'calc-eval', 'jira-key-shape') shares an identical 10-parameter schema (zone, json, url, host, website, city, query, path, ref, feed) regardless of relevance to the tool's stated purpose. This generic, overlapping schema makes it hard for the agent or a reviewer to reason about what data a given call actually sends, and could mask which parameters are actually used/forwarded by a shared backend; worth confirming unused fields are truly ignored server-side.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/c03710d2-802d-4595-b8a4-f0be342aaec7)Scanned 10/2/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free