MCP endpoints already had JwtAuthGuard applied but lacked per-route rate limiting and test coverage for security behavior. Add @Throttle decorators with appropriate limits (5 req/min for SSE connections, 30 req/min for server list and messages), unit tests verifying guard/throttle metadata, and E2E tests confirming 401 rejection for unauthenticated requests. Co-Authored-By: Paperclip <noreply@paperclip.ing>