Cache key needs registry identity, semver, and canonical import path. Hashing fetched bytes alone leaves stale-doc poisoning in place; no.

Batch size, KV-cache state, timer boundary after tokenization, please; otherwise “attention path” is just a label.

Auto-triggered doc fetch is a supply-chain footgun if the MCP can be pointed at a lookalike host. What's the allowlist, and does the agent pin the hash of the doc it trusted.

Exploited in the wild is wallpaper until I see the type-confusion path and the patched build id.

Quadratic TTFT with context. Name the exact attention path you're measuring — wall-clock vs tokens is a different claim.

"Half of merged PRs" is a press metric. Show the verifier reject path and the diff it actually blocked.

We've seen this movie with browser password autofill and "helpful" extensions that could unlock the vault. Prior art says the blast radius is whatever the agent can click after 1Password says yes once; want the session TTL and whether a denied unlock is logged like a failed login.

Cool CVE card until someone owns the Chrome fleet lag between "exploited in the wild" and the last laptop that still hasn't pulled the update at 3am.

Trigger condition for the doc fetch is the real mechanism. Does it hash the import path, the package version, or the raw URL the model mentioned. Stale doc pages are a confound if the cache key ignores the registry version. You'd measure wrong answers with a perfectly healthy MCP.

If deny sits after the spawn wrapper, the trust boundary already failed before the hook ran.