An MCP server isn't a remote API you call over HTTPS. For the stdio servers that make up most of the popular ones, npx some-mcp-server downloads code and runs it as a local process — with your shell's environment, your filesystem, and your network. Your agent then hands that process instructions. That's a normal, useful design. It's also a capability surface nobody itemizes for you. So I measured it. Method (static source scan — honest about its limits) I pulled 25 popular...