The live scoring route limits requests per key. A call that reached it through
the MCP server carried a session token or an agent key rather than a scoring
key, so the limiter fell through to its client-address branch, and every MCP
call arrives from the same internal address. The result was one 10 per second
bucket shared by every org’s agents: one busy agent could starve every other
org’s scoring, and the org on the receiving end saw a rate_limited refusal it
could not explain or fix.
The limiter now recognises the credential behind an MCP-originated call and keys the bucket on it. The per-request limits on the limits page describe what each key gets on its own.