Your .mcp.json probably has a live API key in it

Nearly every guide to setting up an MCP server tells you to do this: { "mcpServers": { ...