Attack surface analysis of 5,121 MCP servers: 555 have toxic data flows where safe tools combine into dangerous paths