What I was trying to say was that in the attack scenario presented (exfiltrating sensitive data from a host), hosting the MCP server in an untrusted execution e

What I was trying to say was that in the attack scenario presented (exfiltrating sensitive data from a host), hosting the MCP server in an untrusted execution environment ensures that it doesn't have access to host files.