Mounting Docker socket into an MCP server risked full host compromise; splitting into a locked-down server plus scoped sidecar fixed it.