You Trust MCP Servers Because of Who Built Them. That’s the Problem.
MCP server trust tooling verifies who published a server but not what it does at runtime. A developer ran 70 MCP servers in a sandbox and logged their actual behavior — revealing environment variable reads, undocumented network calls, and output manipulation that no static analysis would ever catch. Identity is not behavior, and the gap between them is where the real security threat lives.