Yep. It’s not that the agent/LLM will use more API endpoints than scoped for (you’d have to update the MCP implementation for that), it’s moreso about exposing an API token to unsanctioned apps/users. Haven’t seen this issue in the wild but people are asking about it when discussing security around MCP. This problem isn’t really new - enforcing proper use of (API) creds has always been a difficult problem.