The article doesn't specify what is actually being measured — the model alone, or the harness.

I haven't noticed the symptoms myself, but ever since I found --system-prompt '', I always use that flag with Claude Code, plus I've disabled some tools and skills to save initial context. So... what here is the model, and what is the instructions?

There is nothing specific to MCP here. But that doesn’t mean there’s no problem. The real problem is that OS does not contain a convenient for users and reliable access control mechanism for local TCP connections (at least at the per-application level of granularity). Would such a mechanism existed, the user could allow connections to its MCP only to the necessary applications. There is already many apps providing local servers, all of them is potential point of attack for bad actors in system: ollama, syncthing, adb, gradle, various torrent clients with web interface, media players, etc...

You might like kanboard, it's a classic LAMP project but it can use sqlite for small installations.

I'll second that. I've used it a lot for my own small projects.

Super, ta, I'll have a look at that.