It's a shame MCP didn't end up using a sandboxed shell (or something similar, maybe even simpler.) All the pre-MCP agents I built just talked to the shell directly since the models are already trained to do that.