Your MCP Server Needs a Capability Budget, Not Just Auth

Most MCP security checklists stop at “is this caller authenticated?” That is necessary, but it does...