I'm thinking more as a provider. Why put a model on my side to handle permissions/scope/auth/actions when thats already handled (or easy enough to spin up)by a

I'm thinking more as a provider. Why put a model on my side to handle permissions/scope/auth/actions when thats already handled (or easy enough to spin up)by a rest-inspired http api? If you're needing to give the model direct and broad access to your SqlServer instance...I don't get it. Dedicated customer facing API is like whitelisting approved actions; MCP feels like getting an LLM to enforce a complex blacklist.