From Dev.to
Run security checks against your own MCP server in CI, and see the findings in GitHub
Most MCP security tooling reads a server's tool descriptions. That finds text that looks suspicious. It does not tell you what your server does when a client calls it. This post is about a small comma...