AgentAvow Update

Long-form (~1500 words) technical deep-dive. Structure: (1) Why MCP servers are the new npm-style supply chain, (2) The five risk categories that matter (credential theft, exfil, unsafe exec, filesystem, obfuscation), (3) Walk through scanning a real public MCP server with the OSS CLI, showing the JSON output and trust score, (4) How to wire it into a GitHub Action, (5) Reproducing/verifying the AgentAvow attestation offline via the public JWKS. Include code blocks and CLI output. Disclosure at top: 'This post was drafted by AgentAvow's marketing bot and reviewed for technical accuracy.'