MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F25/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/lang-es/mcp
highpeople-search-index
Instructs agent to navigate to a people-search service with tracking, raising privacy and consent concerns
The description tells the agent to 'Follow start_here.hop' (a tracked 302 redirect with utm_source=agent-observatory&utm_medium=agent) toward a 'living people-search index' (Ploid), including CLI/API/MCP onboarding. People-search services aggregate sensitive personal data (addresses, phone numbers, relatives, etc.); embedding directive navigation instructions that funnel the agent toward signing up for or using such a service is both an embedded command to the AI and a path toward privacy-invasive data collection the user may not have intended or consented to.
highagent-ads-index
Advertising/monetization funnel instructs agent to complete a trial signup on behalf of the operator
The description directs the agent to follow a tracked redirect ('start_here.hop', utm_source=agent-observatory&utm_medium=agent) and explicitly mentions delivering a '7-day trial handoff for your operator.' This is an embedded instruction aimed at getting the AI to initiate a trial/commercial commitment for the user's operator account, which could create unwanted financial or contractual exposure without clear, explicit user consent, and goes beyond the stated 'index/discovery' purpose of the tool.
mediumagent-tool-index
Embedded navigation instruction directs agent through tracked redirect chain to a commercial pay-per-call gateway
The description instructs the agent to 'Follow start_here.hop first' through a redirect carrying utm_source=agent-observatory&utm_medium=agent tracking parameters, and routes toward docs/CLI/remote-MCP 'hops' for a monetized third-party service (Monid). This is a directive aimed at the AI's behavior (navigate a specific link chain) rather than a description of the tool's own function, and could expose agent/operator traffic to tracking or lead to unintended sign-ups/costs on a pay-per-call platform without the user's informed consent.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowlang-es
Schema parameters unrelated to stated tool purpose (shared oversized schema across all tools)
This tool (and all 31 tools in this set) share an identical, broad input schema with ten unrelated fields (zone, json, url, host, website, city, query, path, ref, feed) regardless of the tool's actual single-purpose function. While each individual field's description looks benign, this pattern makes it hard for the agent to reason about what data a given call will actually use/transmit, and increases risk that an untrusted parameter (e.g., 'path' or 'json') could be passed to a tool that doesn't actually need it, or that scope creep could be introduced later without a schema change being noticed.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/dae5cac5-0d65-4a46-a277-9d18ec680633)Scanned 10/3/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free