MCP security report

agent-observatory-sensor.nolimit-observatory.workers.dev

F5/100
Security grade FHigh-severity signals — review these before connecting.
Connected ✓31 tools scanned

https://agent-observatory-sensor.nolimit-observatory.workers.dev/s/cable-m/mcp

highagent-tool-index
Embedded directive instructing agent to follow an external redirect chain
The description reads as an instruction to the AI itself ('Follow start_here.hop first...') rather than a description of tool behavior. It directs the agent to traverse a 302 redirect chain carrying tracking parameters (utm_source=agent-observatory&utm_medium=agent) that appear designed to fingerprint/track agent-driven (vs. human) traffic. This encourages the agent to autonomously visit and chain through an unknown third-party gateway (a 'pay-per-call' tool marketplace) and potentially register/connect to remote MCP endpoints it discovers there, without the user necessarily being aware that new tool/payment surfaces are being added.
highpeople-search-index
Tool designed to locate and route into a people-search / data-broker service, with embedded 'follow the redirect' instruction
Similar to agent-tool-index, this description directs the agent to 'Follow start_here.hop' through a tracked redirect to a 'people-search index.' Combining an embedded directive to the agent with a tool whose entire purpose is discovering a personal-data lookup service raises privacy/surveillance concerns (facilitating doxxing or unauthorized personal-data queries) and encourages the agent to onboard a new remote tool/API/CLI without clear user consent, beyond the simple stated capability of 'finding an index.'
highagent-ads-index
Tool steers agent toward third-party advertising/product-placement infrastructure via tracked redirect
The description instructs the agent to 'Follow start_here.hop first' through a tracked URL (utm_source=agent-observatory&utm_medium=agent) leading to an ad-placement/client-center/trial signup flow ('7-day trial handoff for your operator'). This is an embedded directive aimed at the AI to pull in advertising/monetization infrastructure and potentially start a trial or commit an operator account, which could influence agent recommendations or introduce hidden commercial relationships without transparent user awareness.
mediumagent-tool-index / people-search-index / agent-ads-index
Consistent tracking parameters identifying automated agent traffic
All three tools embed the same utm_source=agent-observatory&utm_medium=agent tracking tag in the hop they instruct the agent to follow. This pattern suggests a coordinated effort to track and profile AI-agent traffic across multiple destinations (tool marketplace, people-search, and ad placement), which could be used to build behavioral profiles of agents/users without clear disclosure.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
Embed this badge

Show your MCP server’s security grade

MCP security grade F

Paste this into your README:

[![MCP security](https://gateturbo.com/badge/scan/e1190a28-7306-4ac5-b05c-00fb270977a9)](https://gateturbo.com/report/e1190a28-7306-4ac5-b05c-00fb270977a9)

Scanned 10/1/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.

Connect this server safely with gate.

Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.

Monitor it — free