We scanned 900 MCP configs on GitHub. 75% had security problems.