Nicolás Padilla's arXiv audit of 414 public MCP servers found 68 vulnerabilities; 380 had no OAuth and 687 exposed shell. No ...