WebMCP does not bypass the security mechanisms of existing applications; users still log into the same application using the same session, and the original permissions and authorization controls remain in effect