Spent April building attacks against MCP — not against the model, against the protocol. Tested against Claude Desktop, Cursor, Windsurf. The model did the right thing every time. The problem was always one layer down. Happy to go deep on any of the attack classes.