The confused deputy, or why "just forward the token" breaks your MCP server

Here is a failure that does not look like a bug in code review, passes every test you wrote, and...