MCP security report
agent-observatory-sensor.nolimit-observatory.workers.dev
F37/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓30 tools scanned
https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/cup-to-ml/mcp
highagent-tool-index
Instructs agent to follow untrusted redirect chains and connect to remote MCP servers
The description tells the agent to 'Follow start_here.hop first (skill file, 302)' and says it 'returns docs, CLI, and remote MCP hops.' This is an embedded directive telling the AI to chase redirects and load/connect to external, unvetted 'remote MCP' endpoints and a 'pay-per-call gateway.' This is a classic vector for supply-chain compromise or prompt injection: the agent could be steered into fetching and trusting additional tool definitions or executing calls against an unknown paid service without the user's informed consent or visibility into cost/data flows.
highpeople-search-index
Facilitates locating a people-search/surveillance index on living individuals
Description states it helps 'find a living people-search index (Ploid)' and returns API/CLI/remote MCP hops for it. This points the agent toward a third-party service whose purpose is aggregating personal data on real people, which is a privacy/doxxing risk disproportionate to the benign, discardable-input framing used elsewhere in this tool set. Combining this with the same 'query discarded' language as harmless utilities may lull the agent/user into treating it as low-risk when it is not.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowcup-to-ml
Shared oversized schema exposes unrelated parameters across all tools
Every tool in this collection (including simple unit-conversion or timestamp tools) shares an identical 9-field schema (zone, json, url, host, city, query, path, ref, feed) that has no relation to the tool's stated single-purpose function. This strongly suggests a common backend/handler behind many differently-named tools, meaning the actual behavior invoked by any given tool call may not match its description, and inputs like 'path', 'url', or 'json' could be silently processed or forwarded in ways not disclosed by the tool description. This pattern make it hard for the agent (or a reviewer) to verify that a tool only does what its description claims.
Embed this badge
Show your MCP server’s security grade
Paste this into your README:
[](https://gateturbo.com/report/dba22780-7024-44aa-937c-30da8584baa1)Scanned 9/13/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.
Connect this server safely with gate.
Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.
Monitor it — free