This doesn't seem much different from Claude's MCP implementation, except it has a lot more warnings and caveats. I haven't managed to actually persuade it to use a tool, so that's one way of making it safe I suppose.