We started running every MCP server we grade. Here's what 20 popular ones actually did.
This story is from 2026-10-02. It is preserved in the archive; the latest stories are on the live feed.
Both big AI platforms check an MCP server the same way before listing it: they verify the domain, read the self-declared annotations ( readOnlyHint , destructiveHint ), and scan the policy text. Then they contain the tool at runtime. Nobody checks whether the tool behaves the way it declares. So we…
Read the full story at DEV Community — AI ↗
Timeline · 1 report
- 2026-10-02 20:34 · DEV Community — AI
We started running every MCP server we grade. Here's what 20 popular ones actually did.