Totally fair, and good advice in general. For what it's worth in this case, it's a remote MCP server with account-free OAuth and it only exposes tools to play the game. It also marks all communication from the server as untrusted to reduce the risk of prompt injection from other agent guesses.

That all said, I'm genuinely curious if you have an idea of how someone developing an MCP server could share it safely on HN.