Nice breakdown of the four checks, especially the tool-description-as-prompt-injection vector. Most people miss that one because the description looks fine in isolation. The only way to catch it is knowing who published the server before its tool catalog enters the model's context.
The stdin inheritance bug is the kind of thing you only find by running into it headfirst. I've hit the same pattern with subprocesses inheriting API keys through environment variables. Explicitly scoping what a child process can see fixes both.
Curious how you gate this in CI. Is it a pre-approval step per server or do you cache trust and skip re-verification on repeat use? At CAI we use a credential vault that handles pre-connect verification so servers only need to prove their identity once.
Registration scans help and still leave a race after connect. Tools can re-advertise after you greenlit the server. A pinned package version does not freeze the description text the model re-ingests on the next tools/list. Re-scan every refresh or the first pass is theater.
"An MCP server is untrusted input wearing the costume of infrastructure" is the sentence this whole topic has been missing, and scanning the full schema rather than the description string is the detail that separates this from every other MCP security post; enum values and nested field descriptions are exactly where payloads go once description-scanning becomes common. One honest addition to your registered-is-not-vetted point: discovery-side signals do not solve it either. I run Skillselion, a directory that ranks MCP servers by adoption, GitHub stars in their case since registries do not report install counts for servers (skillselion.com/mcp ; disclosure: mine), and I would be the first to say adoption numbers measure popularity, not safety; a widely installed server with a poisoned update is a bigger blast radius, not a smaller one. Directory metadata can tell you what exists and what changed between versions; your four checks are what earn the trust. The version-pinned scan logs are the piece I am stealing.