Right — replay is the easy half. The reason we bind the 402 to method+SHA256(body) is that the token then only buys one specific call, so a token minted for a cheap GET is worthless on a paid POST.
On scale: agreed the probe is the missing piece. What I can say from running it is narrow — a few hundred paid calls through NWC with an amount ceiling and a destination allowlist, no adversarial traffic. That's a shakedown, not a security result. If your probe can push an injected 'pay X to Y' through a tool return and see whether the payment call gets constructed vs. requested, I'll wire it against a test wallet with a 1000 sat ceiling and publish whatever it finds, including the failures.
On scale: agreed the probe is the missing piece. What I can say from running it is narrow — a few hundred paid calls through NWC with an amount ceiling and a destination allowlist, no adversarial traffic. That's a shakedown, not a security result. If your probe can push an injected 'pay X to Y' through a tool return and see whether the payment call gets constructed vs. requested, I'll wire it against a test wallet with a 1000 sat ceiling and publish whatever it finds, including the failures.