Three merged PRs in an MCP security scanner: the review that found my bug, and two more

What actually landed in mcp-guard this week: an npm attestations verifier whose happy path could never fire (caught in review), keyword matching without false positives, and exit codes as API.