The Model Context Protocol is a great tool for feeding LLMs structured data. But let's be honest, the current security model is basically "hope the server you're connecting to is nice." The 'S' should stand for 'Sandbox', because right now it's more of a 'Suggestion'.

We're handing tools, filesystems, and APIs to models with minimal isolation. The protocol has auth, but how many devs are actually implementing granular permissions vs. a simple allow-list? The abuse cases are obvious:
* A poisoned prompt telling the model to `read`/`write` outside its intended scope.
* Tool calls being used to exfil data or probe internal networks.
* No real resource limits on execution time or memory.

We need a default-deny, context-aware sandbox around the tool calls, not just transport security. Until then, every MCP server is a potential pivot point.

Example of a naive server config that's way too permissive:

```json
{
"mcpServers": {
"internal_tools": {
"command": "node",
"args": ["./server.js"],
"env": { "DB_CREDS": "xyz" }
}
}
}
```
If that server exposes a `queryDatabase` tool, what's stopping a clever prompt from asking it to dump everything? The 'S' is silent.