This MCP Server Trick Can Steal Your API Keys and more—Watch Out!