the injection detection piece is the part i want to understand better -- when an mcp tool returns unstructured text (llm-generated content, scraped data, user posts), and that output gets passed to the next agent step, the attack surface is not just in the tool call itself but in what the tool returns

curious how mcpdome handles that: does it scan response content for injection patterns, or only the request side? the tricky case is a tool that fetches data from external sources -- the injection payload lives in the third-party data, not in the mcp message structure

the auth/rate-limiting model here is interesting compared to x402 (where access is enforced via payment verification at the api level rather than a proxy layer). different threat models -- auth assumes trusted agents, payment verification is trust-minimal