The Model Context Protocol (MCP) has lowered the barrier to connecting external tools to AI agents, but it hasn't solved the trust problem. XData, an open-source research project led by AI engineer John Jazbec, recently sandbox-tested 23 MCP servers to determine how many could actually withstand runtime scrutiny. The results are sobering for developers deploying agents in production: only one server, Playwright, achieved the highest verification level.

The Verification Gap

XData's AgentHub project introduces a four-level verification framework designed to move beyond simple directory listings. The levels range from L0 (Catalogued) to L3 (Runtime Tested). In the November 1, 2026 snapshot, the data shows a stark distribution: 15 servers were only identity-verified (L1), 7 remained merely cataloged (L0), and just 1 reached L3. This highlights a critical infrastructure gap where most available MCP integrations lack reproducible evidence of their security characteristics or observable runtime behavior.

Playwright's Runtime Behavior

Playwright was the sole server to pass L3 testing, which involves execution inside a gVisor sandbox with restricted filesystem access, network destinations, and credentials. During the test, Playwright correctly limited filesystem writes to /tmp and spawned expected Chromium processes. However, the sandbox also caught Chromium attempting to connect to external Google DNS endpoints. While the sandbox blocked these connections, the observation proves that even well-known tools can exhibit network activity not immediately obvious from their exposed MCP tool definitions.

Beyond Static Analysis

The XData team argues that recognizing a publisher or inspecting documentation is insufficient for production use. Their framework asks five core questions: Who published the server? Can the artifact be verified? What vulnerabilities exist? What permissions are exposed? And what does it actually do when executed? This approach treats MCP servers as software artifacts requiring the same rigorous supply chain scrutiny as any other dependency, rather than trusting them based on name recognition alone.

Key Takeaways

  • Only 1 out of 23 tested MCP servers achieved L3 (Runtime Tested) status in the initial snapshot.
  • 15 servers passed identity verification (L1), while 7 remained unverified beyond listing (L0).
  • Runtime testing in gVisor revealed hidden network calls to Google DNS from Playwright's Chromium backend.
  • XData AgentHub is open-source and MIT-licensed, also offering 104 security-reviewed AI agent skills.

The Bottom Line

If you're wiring MCP servers into your agent stack, treat 'available' as 'untrusted' until you see runtime evidence. The gap between a documented API and actual sandboxed behavior is where security incidents live.