Interesting thought, especially the npm comparison. The place MCP gets stranger is that a poisoned tool does not always need to execute code. Its description can sit in shared context and steer another tool, which makes context isolation part of the security boundary.