An agent becomes dangerous when it can read private data, takes in text someone else wrote, and has a way to send data out. Simon Willison calls this the lethal trifecta. Our last note walked through the GitHub MCP leak of May 2025, where one public issue was enough.
A handful of small open-source tools now promise to spot the trifecta in an MCP setup before anyone exploits it. We wanted to know whether they do, so we ran them on real servers.
We took nine MCP servers people install today: GitHub’s official server, Supabase, Playwright, Notion, a popular Slack server, and the filesystem, memory, fetch and git reference servers. Eight of them listed their tools inside a container with no network. Supabase’s docs tool fetches a schema while listing and the Slack server calls Slack at startup, so for those two we read the tools from the source at the same pinned version. That came to 180 tools, and we labelled each one by hand with the capabilities it grants and a line of reasoning.
From those servers we built thirteen scenarios. Seven hold the trifecta, including GitHub on its own, Supabase on its own, and the classic pair of local files plus a tool that fetches web pages. Six do not.
Four checkers ran on every scenario: lethal-trifecta-lint, mcp-trifecta, triflow and trifecta-check. We left out a fifth, tracewall, because it is a runtime firewall that judges calls during a session and has nothing to run on a tool list. Every run used a fresh container with no network and a read-only filesystem. We ran the whole set twice and got the same results.
| Checker | Trifectas caught | With the right reason for all three | False alarms | GitHub alone |
|---|---|---|---|---|
| mcp-trifecta | 5 of 7 | 2 | 0 | caught |
| triflow | 3 of 7 | 1 | 0 | caught |
| lethal-trifecta-lint | 2 of 7 | 1 | 0 | caught |
| trifecta-check | 0 of 7 | not applicable | 0 | missed |
We counted a catch as “right reason” only when the checker pointed at a real private-data tool, a real untrusted-content tool and a real way out.
All four missed local files plus fetch, an agent that can read your files and load any URL. The three that read tools all label fetch as untrusted input and nothing more. None of them treats it as a way out, yet a URL is all an attacker needs to receive the data. Willison puts it plainly: a tool that can make an HTTP request can pass stolen information back to an attacker.
The best score hides the second problem. mcp-trifecta caught five of seven, but only two of those catches rest on the right tools. It flags git plus fetch because it reads the local git_commit and git_log as exfiltration, while fetch slips past it. These checkers match words in tool names and descriptions, so a server that names its tools differently can flip that answer.
GitHub’s server on its own was the one case that went well. Three of the four flagged it, and it is the only scenario all three tool-reading checkers got for the right reasons. trifecta-check missed it because it never reads tools at all. It matches server names such as “filesystem”, “fetch” and “slack”.
MCP lets a server mark each tool as read-only or as reaching the outside world. Seven of the eight servers we listed live publish a read-only flag, and none of the four checkers reads it. Annotations would not have fixed the main miss, though, because the fetch server publishes none.
No checker raised a false alarm on our six safe scenarios. Those scenarios are simple, so we would not read much into it.
If you use one of these tools, keep its green result as a first pass and still list your agent’s tools yourself. Mark any tool that can reach an outside address as a way out, including fetch, browsers and anything that loads images. Look at single servers too. By our labels GitHub, Supabase, Playwright, Notion and, in its default setup, Slack each hold all three on their own.
Our labels are judgement, and two calls are close. Slack’s default setup has no message tool, so it reaches the outside only through user group descriptions that every workspace member can read. We count Notion writes as a way out because teammates and guests read the workspace. Thirteen scenarios is a small set, and these checkers are young projects that will change.
Everything is in trifecta-bench: the 180 labelled tools with their reasons, the scenarios, the adapters, the runner and the raw output of every run. Adding a checker takes a Dockerfile and a small adapter, and anyone who disagrees with a label will find our reason right next to it.