Audit of 1,384 tools across 28 MCP servers finds risky source-sink pairings

A static survey of 28 popular Python MCP servers (AWS, Google Workspace, Atlassian, Home Assistant, Snowflake and others) counted 1,384 tools: 239 ingest untrusted content, 384 perform high-impact actions, and 59 do both. In 14 of the 28 servers, sources and sinks sit in the same agent context with no isolation.

• 239 tools accept URLs, files or documents from outside
• 384 tools run commands, queries or writes
• 59 tools both ingest untrusted data and act on it
• 14 of 28 servers expose sources and sinks in one context