Nice breakdown of the four checks, especially the tool-description-as-prompt-injection vector. Most people miss that one because the description looks fine in isolation. The only way to catch it is knowing who published the server before its tool catalog enters the model's context.

The stdin inheritance bug is the kind of thing you only find by running into it headfirst. I've hit the same pattern with subprocesses inheriting API keys through environment variables. Explicitly scoping what a child process can see fixes both.

Curious how you gate this in CI. Is it a pre-approval step per server or do you cache trust and skip re-verification on repeat use? At CAI we use a credential vault that handles pre-connect verification so servers only need to prove their identity once.