When the MCP Server Is the Payload: Attacking MCP at the Implementation Layer

MCP replaced manual API wiring with one open protocol — and in doing so created a new attack surface where the server itself is the payload. Nothing in the protocol separates a description that documents a tool from one that commands the model. Part 1 of a two-part series.