An MCP server isn't a remote API you call over HTTPS. For the stdio servers that make up most of the popular ones, npx some-mcp-server downloads code and runs it as a local process — with your shell's environment, your filesystem, and your network. Your agent then hands that process instructions.
That's a normal, useful design. It's also a capability surface nobody itemizes for you. So I measured it.
Method (static source scan — honest about its limits)
I pulled 25 popular Model Context Protocol server packages and statically scanned the published package code (not runtime behavior) for four things:
net-call sites — does the code make outbound network calls?
