Yes, actually I have found a solution; at least it works for me.
The idea is laid out in detail here: blog.iluxav.com/the-attack-was-authorized-the-mis…
TLDR;
User vendor access key with its scopes belongs to the actual user and is hidden from AI agents. Instead, there are cryptographically derived keys that can only narrow down the permissions and ONLY with the user's explicit consent for a short period of time. The approval flow works via OpenAI elicitation protocol that pops the consent in the chat, or it could be done externally via Slack, Teams, emails - whatever
The point that an MCP server is purely an interface, and an agent with shell access can just bypass it, is what most of the MCP hype skips. For local agents I've landed in the same place: a well-shaped CLI is easier to reason about, and the security boundary is imaginary either way. The unsolved part is the one you name, trusting third-party code running with my privileges. Have you found anything that actually constrains that, or is it still read-the-source-yourself?