Where the base assumption of a secure environment for user interfaces is replaced, the package adds threats of eavesdropping, manipulation, combination of information across interfaces, masquerade and impersonation, objectives for a trusted path with user authentication and reaction to failed authentication, refined emanation security, environment objectives for protected communication and authentication data, and the trusted-path and user-authentication SFRs for remote users.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.