MCP is a good boundary for the tools themselves, but the write path was hard. Agents stayed well behaved on reads and then raced each other writing the same file, because nothing in the capability layer knew two edits were meant to be one change. Guarding the tool call is not the same as guarding the transaction.