WebMCP makes websites agent-ready, but every exposed tool becomes an attack surface