Hah, I made that same point last December: https://simonwillison.net/2025/Dec/31/the-year-in-llms/#the-...

> For a while it also felt like MCP was a convenient answer for companies that were under pressure to have “an AI strategy” but didn’t really know how to do that.

I've since come back to MCPs, because I want to build my own agents without first having to solve the problem of effectively sandboxing Bash.

Yeah, from a design perspective MCP upsets me, because it’s a poorly designed standard and creating a good one could have been much easier.

But you’re right, since clients don’t have a nicely sandboxed “make api request” tool, it’s basically the way to go for a lot of use cases.

"without first having to solve the problem of effectively sandboxing Bash"

Hopefully this is easier as time goes on. Of course- also policy on the egress