It can be, however it's not fully deterministic, because the agent can hallucinate or misbehave, which is fairly common. Because MCP is a separate process, we can ensure that safety pipeline is fully followed.