codex CLI is already leveraging this internally. instead of performing raw MCP calls its internally using a js REPL to do that. elicitation is then propagated for approvals independently / it's interpreted as regular tool calls for operators etc.

so if i were to tell an agent to move the contents of a confluence doc into a file, it would do so without even reading the confluence page - in theory.