The first ninety days of an MCP server in production are about correctness, not abuse. The team is busy proving the agents do the right thing: the policy lookups return what they should, the audit log captures the right fields, the structured errors are parsed by the agent framework correctly. Rate limiting is something the team plans to add "after we have real traffic." The team has real traffic on day 12 and forgets to add rate limiting. On day 87 the first runaway lands. The runaway always has the same shape. One agent starts behaving badly: a test loop forgot to set max_iterations, a malformed prompt drove the model into a long-output failure mode, a retry policy got an aggressive backoff inverted. The agent calls the same MCP tool 400 times in 30 minutes, burning 70% to 90% of the day's token budget before any human sees the alert. By morning the bill shows a $4,200 charge against an Anthropic account that usually does $800/day. The structural fix is per-agent token quotas baked into the MCP server.…