Or running local commands or talking to an MCP server at a random domain unrestricted by content policy