Great call. We already block certain tool schemas and flag URLs in tool-call arguments, and since we enforce org allowlists for models on every request, extending that to tools/MCP is a natural next step.