Threat model

Risk	Real?	Priority	Treatment
Stale local list	Yes	High	Online membership query; local data only as short-lived cache
k-anonymity dictionary attack	Yes	High	Retire prefix buckets; authenticate, rate-limit and correlate anomalies
/stats leakage	Yes	Medium	Coarse, delayed service health only
Plaintext local tokens	Yes	High	Memory-only web token; OS credential facility for CLI
Filtering after WebFetch	Yes	High	PreToolUse URL check before the network request
Ban propagation delay	Yes	Medium	Authoritative consistent state; short-TTL Bloom filter only as a fast path

A Bloom filter cannot be authoritative: false positives can deny benign users and Worker isolate memory is not globally shared.