I’ve noticed Claude Codes sandbox mode works with MCPs. With CLIs I’ve rain into permission issues. CLIs also need reminding about whats available unless references are baked the context window.