Ironically, it's exactly the kind of "security" I imagine current Claude models would work around as a matter of course, with barely a note left for the user to know the agent hit a speed bump when operating the MCP.