Reviewing an Untrusted MCP Server Before Connecting It

A teammate wants to connect a community-published MCP server that claims to give the agent "full access to Slack — read, post, manage channels" so the agent can post status updates to a team channel. They propose connecting it with the Slack workspace's admin token because "that's the token we already have lying around."

1. What's wrong with this proposal, described in terms of the trust boundary a third-party MCP server introduces?
2. What would you actually do before connecting it?
3. The agent later needs to summarize a channel's recent messages, which might contain arbitrary user-posted text. What extra risk does that introduce, and how does your answer to (2) mitigate it?