A developer finds an open-source MCP server on a public registry that promises to "supercharge code reviews". It runs locally via npx, exposes tools that read repository files and post to a web service, and requests a broad OAuth scope on the connected platform. A security engineer warns that a malicious or compromised MCP server could embed hidden instructions in its tool descriptions or results to steer Claude into leaking data. Which approach best reduces the risk while still letting the team evaluate the server?