MCP's are precisely the opposite of "letting agents input whatever they want", even if a lot of MCP servers just do that.
The whole point of an MCP is to expose a subset of API functionality to an agent in a structured way with limited access, as opposed to just giving them access to a bash prompt or to run python code with the user's access.
The whole point of an MCP is to expose a subset of API functionality to an agent in a structured way with limited access, as opposed to just giving them access to a bash prompt or to run python code with the user's access.