Section 1
Remote-first questions
- is transport encrypted and identity clear?
- are credentials living in the URL or another brittle place?
- what happens if the endpoint is wrong, compromised, or over-broad?
- what secrets, paths, or outputs can the server influence?
Section 2
Signals worth slowing down for
Credential-bearing URLs, insecure transport, broad environment inheritance, and sensitive remote targets should force an explicit review decision.
Section 3
How to evaluate safely
Use a local static scan first, then validate the runtime choice separately. Do not collapse config review and live trust into one step just because a quickstart worked.