Given our spectacular inability to make "regular" programs secure in the absence of all that fuzziness, I don't know if it's a good idea.
The fact is that these MCPs are allowed to bypass all existing and well-functioning security barriers, and we cross our fingers and hope they won't be manipulated into giving more information than the previous security barriers would have allowed. It's a bad idea that people are running with due to the hype.
"our" - *base users? I only hear about *base apps shipping tokens in client code or not having auth checks on the server, or whatever
Jumping head first into an entire new "paradigm" (for lack of a better word) where you can bend a clueless, yet powerful servant to do your evil bidding sounds like a recipe for... interesting times.