How do you decide which MCP servers to trust?

Every MCP server you add is code running with your permissions: your files, your network, your tokens. Most of us install them from a README and a star count.

Do you read the source? Pin versions? Run them in a container?

In kosa8 each MCP server gets its own network allow-list and its own audit trail. Curious what everyone else does today.