Most MCP security writeups (including a few of mine) focus on a single server: does this one tool description contain a hidden instruction, does this one manifest request too many scopes. That's the easy case to scan for because everything you need is in one file.
The case that's harder to catch, and that I haven't seen a scanner actually check for, is what happens when a model has two or more MCP servers connected at once and neither one is individually malicious. You get a confused-deputy problem: server A holds a capability (say, "send email" or "write to this repo"), server B holds untrusted content (say, "read this webpage" or "read this issue"), and the model happily uses A's capability on data it just pulled from B, because nothing in either server's config told it not to.
A concrete example
Say you've got a "fetch a URL and summarize it" MCP server and a "send a Slack message" MCP server both wired into the same agent. Individually both are boring, useful tools. Chained, the failure mode looks like this:
User asks the agent to summarize a doc at some URL.
