Berkeley RDI

CVE-2025-54136 turns a one-time MCP approval into a permanently mutable surface

The poisoned field is inputSchema, which the framework parses and executes against while the model's safety training never evaluates it, so the only gate that holds is a hash recomputed at every call.