With tens of thousands of Model Context Protocol (MCP) servers published in 2026, AI agents now have direct execution bridges to local terminals, filesystems, and production databases. Following 30+ CVE disclosures against MCP tools in early 2026 alone (including CVSS 9.4+ RCEs), verifying the security of MCP servers before plugging them into Claude Desktop, Cursor, or autonomous agent runtimes has become critical. However, existing scanning approaches suffer from two fatal flaws: A...