Suggestion: encourage security scanning for community server submissions

[mcpcustoms]

As the MCP ecosystem grows, the number of community servers is
expanding rapidly — and with it, the surface area for supply chain
risk. MCP servers can read files, execute commands, and make network
calls on behalf of AI agents, yet there's currently no expectation
that submitters have checked their server for common security issues
before listing it.

A few options worth considering:

1. Add a recommended pre-submission checklist item suggesting authors
   run a static scan (e.g. npx mcp-customs scan .) before submitting
2. Show a security badge alongside community listings so users can
   see at a glance whether a server has been audited
3. Simply document the risk in the submission guidelines so users
   know to check before installing

Not pushing for any specific tool — the goal is just to make
security hygiene a visible part of the submission culture before
the ecosystem gets large enough that it becomes a real problem.

Happy to help draft any of the above if useful.

[mcpcustoms]

Wrote up a more detailed version of what submission guidelines
could cover here, in case it's useful as reference:

https://dev.to/mcpcustoms/mcp-server-security-checklist-before-you-publish-5gel

Covers the 7 categories with code examples for each — what to
check and why it matters specifically for MCP servers vs regular
npm packages.