It seems to me an alternative to MCP would be a shell implemented to only allow access to white listed commands.

I also feel like a lot of knowledge about how to lock down a multi-user system has been lost. Back when many people shared a single computer through terminals, admins had a lot of responsibility to create a permissions structure such that one user couldn't access another's data or hog too many resources that would impact other users on the system. We are running computers with the similar permission models (Mac and Linux are Unix, Windows has similar controls) but we can't manage to lock down shell access to trust an LLM with it as if it were a human user we don't fully trust.