All of my MCPs, including browser automation, are very much deterministic. My backend provides a very limited amount of options. Say for doing my Amazon shopping, it is fed the top 10 options per search query, and can only put one in a cart. Then email me when its done for review, it can't actually control the browser fully.

Essentially I provide a very limited (but powerful) interactive menu for every MCP response, it can only respond with the Index of the menu choice, one number, it works really well at preventing scary things (which I've experienced) search queries with some parsing, but must fit in a given sites url pattern, also containerization ofc.