I definitely think that's a bridge to gap, but MCP is not the answer. OSes currently lack the tools to do this properly, but I hope they will improve. Agents need more granular sandboxing in all areas.

This is not true by default. There are plenty of poorly implemented MCP servers which do that. The MCP spec supports Oauth and intends to avoid that but it is not enforced.