Your agent connects to three MCP servers, calls tools/list, and suddenly it can search issues, query a database, send email, refund payments, and delete staging environments.
The integration problem is solved. The tools are discoverable.
The safety problem is not.
MCP — the Model Context Protocol — did something genuinely useful: it gave AI clients and external tool servers a common language. Instead of every AI app inventing its own plugin system, a client can now ask a server what tools exist, inspect their schemas, and call them in a standardized way. That is a real step forward for interoperability.
But discoverability is not authorization. A tool list is not a permission boundary. A JSON schema is not a sandbox. And a polite tool description is not proof that the tool is safe.
