what if MCP servers had a Lighthouse-style...

i've been auditing MCP servers for a few weeks now. 194 packages scanned, 118 had security findings. that's a 60.8% failure rate. and these are the ones people are plugging into their AI agents right now. the problem isn't that developers are lazy. it's that there's no visibility. when you npm install @some-mcp/filesystem-server, you have zero signal about whether it sanitizes paths, leaks env vars, or shells out with unsanitized input. we have Lighthouse for web performance. we have Snyk for de