Sure, you have an LLM which can invoke functions. I will say that without storage and composition, you're asking for hallucination. LLMs are not deterministic and while they're good at regurgitating text - you can see how replies in an instruct model are structurally keyed off the question - they will rephrase, adjust, "correct" data they're schlepping from one call result to another call input. And one noisy MCP call and there goes your context.

You could build something with storage and composition out of MCP functions, but come on, have you seen how LLMs - particularly budget LLMs - try and invoke functions reliably? The amount of retries you have to hide, feedback you need to send back to the LLM about what it did wrong. Parameters get replaced with synonyms, arrays are passed for singular arguments and vice versa, structured inputs are flattened, etc.

So maybe you fine tune on interactions with your subset of MCPs, to improve reliability. But all you end up doing is reinventing a Unix-like command line, poorly.

Firecracker micro-VMs, gVisor, wasm sandboxes. There are ways to make this work that aren't heavyweight. Giving LLMs tools that they've seen how to use millions of times in training corpora just works better.