Research: how do you decide an MCP server is safe to connect?

[Paraphern]

We are researching a specific supply-chain risk in agent stacks and collecting practices from real teams. Not a product pitch — findings will be summarized publicly in this thread.

The risk: tool descriptions your agent obeys can silently change after you approve them — maintainer update, compromised registry, typosquatted package. OWASP codified the class as tool poisoning (MCP03:2025). Install-time scanners check before you connect. Nobody watches after.

7 short questions — answer inline, in writing:

1. How many third-party MCP servers does your team run, roughly?
2. Have you ever read the text of a tool description after installing? (yes / no / what is that)
3. Did an agent ever do something unexpected after a server update? What happened?
4. Who on your team is responsible for the security of what agents connect to? (name / role / nobody)
5. How do you decide a server is safe to connect? (gut / checklist / scanner / other)
6. If a free OSS tool pinned tool descriptions at approval and alerted on any change — would you run it this week? What would stop you?
7. Gut check: independent maintainer, crypto-only payments, fully open code with on-chain verifiable releases — problem / meh / fine?

Answers from DMs and other channels count too — we will aggregate everything here.

Context: we built a working CI-gate prototype (hash-pinning of tool descriptions, zero-dep) and a public attack corpus with two rug-pull demos — see the repo. The research decides what we build next.