Keeping tool descriptions static is the check I see skipped most, and it's easy to enforce: hash the tool list at release time and have a CI test fail if the served descriptions or schemas ever differ from the pinned hash. On rate limiting, limiting per tool and per IP still leaves room for one agent session to fan out across many cheap read calls, so a per-session budget on total calls helps too. And for "return only what the output schema promises", validating responses against the schema on the server before sending catches accidental leaks of internal fields when the underlying data model grows.