Redirecting to MCP Security: The Attack Surface Nobody's Talking About