Solid list, especially the rate limiting and resource path traversal points. One area that could use more attention: provenance verification. When you discover an MCP server in a directory, how do you verify it was published by who it claims and hasnt been tampered with? For production agent workflows this is a real blind spot code signing plus identity attestation at the discovery layer would close it.