Deterministic CI scanner and surface-risk scoring for MCP (Model Context Protocol) servers.