Refresh tokens rotate on every use and belong to a family. If a stolen token is ever replayed, the entire family is revoked, and the theft is exposed.

The fix isn't exotic: → Short-lived JWTs (15-min, audience-bound per server) → Tool-level scopes. A read_db token can't call write_db → Tokens carry user ID, agent ID + delegation chain → Every…