MCP tool poisoning demo server. Endpoint: /mcp