Three MCP auth bugs in 30 days, one root cause: Trusting what the other side said

The MCP Python SDK, the Rust SDK (rmcp), and LiteLLM each accepted authentication input that nobody verified. Here is what broke, who is affected, and the checklist that closes the gap.