An arXiv preprint (Penn State, Dartmouth, Montpellier) treats every LLM-generated tool argument as untrusted and turns each tool's own description into security checks plus fuzzing harnesses. Across 273 runnable open-source MCP servers (3,405 tools) it reports 253 hand-verified bugs in 343 tools on 118 servers: mostly reflected output (115), path traversal (64) and log injection (58), plus SSRF, data exfiltration and command injection. The authors also show a "Repeat-After-Me" trick: asking a model to repeat tool-call text verbatim gets the orchestrator to dispatch it, reproduced on LangGraph, MAF, ADK 2.0, AutoGen, Strands and CrewAI. Takeaway: tools must validate their own inputs rather than trust the model or harness. Not peer-reviewed yet.