A reverse shell registered as an MCP tool, a CVSS 9.9 'add server' bug, and an infostealer that reads .claude.json. Here is the list I'd make first.
Your MCP config is now an attack surface: a 20-minute inventory, and the four October incidents behind it
