The MCP section is the part I'd want a straighter answer on before turning it on. It says every tool is read-only, but read-only doesn't really close the exposure your own security section already flags: logs carry tokens and personal data, and an assistant that can fetch and search them can paste a secret into its own context or a downstream call just as easily as a shell command could delete something. The built-in auth section describes per-user filter and role restrictions (shell, actions, download, notifications, cloud), but nothing here says whether an MCP client inherits one specific user's filter and roles the way a logged-in web session does, or whether it authenticates as a single fixed identity with full container visibility regardless of who issued the credentials. If it's the latter, turning MCP on for an assistant that only needs one service's logs quietly hands it read access to every other container on the host too.