The Model Can’t Police Itself: Put MCP Guardrails in the Server

Why security instructions in an MCP server's system prompt are theater, and where the real controls belong: a runtime endpoint allowlist, structured returns, and output scanning, all deterministic code between the model and the API. With the allowlist bug that re-opens the doors you closed.