Yeah, I hit this. I run an MCP server that talks to a corporate messaging API — if it stays connected the whole session, any hallucinated tool call can fire off messages to an entire org while the agent is doing something unrelated.

There's no real reason that connection needs to stay open the whole time. Feels like overkill.

Read-only stuff is probably fine staying persistent, I guess. Anything that sends or mutates state feels different though.

MCP doesn't really have a way to express that kind of boundary per tool, so the runtime can't do much with it.

Haven't tried Orloj yet but "summoned on demand" sounds closer to what I'd want.