> This is 100% a problem with the MCP spec

No, its not.

It’s a problem with the design of agentic workflows. Its on a whole different level of the atack than the MCP spec.

It is a real issue, but not one that it makes sense tor the MCP spec to be concerned with.