An MCP server isn't a URL — it's code that runs on your machine with your environment. I statically scanned 25 popular servers for network calls, secret-env reads, and subprocess spawns. Here's the measured capability surface, and why you'd want it in a sandbox.
I scanned the code of 25 MCP servers — what they can do to your machine before you sandbox them
