I got curious how risky MCP servers actually are, so I pulled the published tool definitions from 28 of the most popular Python ones and counted. 1,384 tools, all read from public source, nothing run.
Two things jumped out:
14 of the 28 give an agent a tool that ingests untrusted stuff (a URL, a file) and a tool that acts (runs a query, sends a message) in the same context, with nothing flagging either one.
And the tool descriptions themselves are written as orders to the model ("you MUST call X first"). That's the same channel a poisoning attack would use, so a bad one blends right in.
Not calling any of it a vuln. It's just what the surface looks like. Harness is reproducible if you want to check my numbers.
github.com/agentsploit/agentsploit/blob/main/docs/mcp-tool-survey.md