Why "Block All PII" Is the Wrong Answer: Handling Sensitive Data in MCP Systems
If your first instinct when connecting an LLM to enterprise systems via MCP is to strip out all personally identifiable information, you’re building a system that is useless. The “block all PII” approach sounds responsible. It checks a compliance box. But it fundamentally misunderstands what MCP-based AI systems do and why they need data in the first place. The real engineering challenge is not blocking data.