A product belongs when its explicit MCP capability secures the live execution path through authorization, inspection, isolation, threat prevention, posture enforcement, or policy controls; generic security products without explicit MCP coverage do not belong.