From Dev.to
Signed, Sealed, Leaked: Trust Beyond Signature for MCP Toolchains
Code signing proves who built a tool. It does not prove what the tool does at runtime. A legitimately signed MCP server can perform its advertised function while exfiltrating conversation history, API...