This is a reason to prefer embedded databases that only contain data scoped to a single user or group.

Then MCP and other agents can run wild within a safer container. The issue here comes from intermingling data.