The big one to watch out for is differing permission models / access for what people can do "on the site" and via MCP. The ideal is the user can use something like oAuth and then are bound to the ceiling of what their account can do but can scope down as needed if delegating to an agent etc.