Someone told me they used MCP in production but insisted they did it safely.

I asked them what integrations they used.

They said they had a Jira integration and one for their company's financial data.

I asked them if they could generate markdown reports with images.

They said they could--that's how they visualized the financial data.

I asked them if they had a feedback form on their site.

They said they did.

I asked them what happens when a user files feedback.

They told me it files a Jira ticket.

At that point it dawned on them that they weren't using MCP safely^[ko][kp].