Most MCP security work assumes the threat lives at runtime, like a malicious prompt, a compromised model. But the vulnerabilities are already sitting in server source code, shipped to npm, waiting.

I audited 100 of the most-installed TypeScript MCP servers at the AST level and found 445 real findings across 70 servers which carried at least one exploitable pattern: command injection from tool input, path traversal, SSRF, and tool-poisoning through dynamically assembled descriptions, the class no prompt filter catches.

This talk shows what those patterns look like in real shipped servers, why they survive review, and why LLM-based scanners miss them. I demo MCPeek, the open-source ts-morph scanner I built to find them: multi-pass taint tracking from tool inputs to dangerous sinks, mapped to the OWASP MCP Top 10, emitting SARIF into GitHub Code Scanning. Fully offline, no model, no cloud, no per-scan cost.

I'll also be honest about what static analysis cannot catch and where dynamic and runtime approaches genuinely win.

Link to MCPeek: https://github.com/iamakash-06/MCPeek NPM Package: https://www.npmjs.com/package/mcpeek