Sanitize strings before passing to MCP tool

Editor assessment

This commit patches CVE-2026-22785. The subject, fix(mdp): Sanitize strings before passing to MCP tool, is a single line with no body, and the scope token mdp appears to be a typo for mcp given the mention of an MCP tool. Sanitize strings is directionally useful but does not say which strings, what injection was possible, or which escaping function was applied. The absence of a body on a security fix means the threat model and the verification steps are missing entirely. It is understandable but too thin to publish as an example, and the scope typo adds noise.