Two weeks ago I published the first piece of this series: the official MCP filesystem server — 228 operations, 174 of them attacks — held all five behavioral invariants. The demo repo was public, the signed Trust Manifest was verifiable, and the headline claim was simple: scanners guess, we prove.
Since then I ran the battery against three more official MCP servers. Not obscure plugins. The reference implementations — the ones every tutorial tells your agent to install. Result: 3 of 4 official MCP servers FAIL adversarial verification. Static scanners pattern-matched their code and emitted passing scores. Execution found SSRF, a transaction escape, and a file-write primitive.
And the part I'm most interested in telling you: one of the FAILs initially shipped from my own harness as a pass. I caught the bug, fixed the driver, re-ran the battery, and re-issued the manifest as FAIL — publicly, with the bug documented. A verification company that downgrades its own verdict is one you can trust with yours.
The method (so you can check my work)
Before execution, invariants are pre-registered per skill: concrete, falsifiable behavioral statements like "the server refuses private-range targets" or "read-query executes only SELECT." The battery is a shuffled, multi-seed mix of honest operations and adversarial cases. An anti-vacuity gate forces the suite to fail if nothing actually executes: every hostile case must land an observed verdict, the server must stay alive, honest cases must succeed. Anything flagged as a finding goes through a debunk-first pass — is this a real property of the skill, or a bug in my harness? Four of our first flags in verification #01 were harness bugs. Fixed, re-run, never shipped.
