Great breakdown of the tool poisoning attack surface. The deployment model matters: local stdio-based servers where tools execute on the user's machine have a very different threat profile from remote servers proxied to external endpoints. The blind spot is that even a benign tool can be weaponized through prompt injection on the MCP host side. Rate-limiting tool invocations and scoping permissions by capability (not per call) would go a long way toward making MCP safer.