MCP's security story today assumes a network in the loop — OAuth 2.1 round-trips to an Authorization Server for delegation, WASM sandboxes with cycles to spare for capability metering, audit trails that land on a central log. That story breaks the moment your MCP host is a phone with no connectivity.
This talk is about what happens when the MCP host is the disconnected edge device. Drawing on a production on-device deployment (Phi-3 Mini, int4-quantized, running via ExecuTorch on Snapdragon's Hexagon NPU, resolving ~80% of queries in under 300ms with zero cloud egress), we work through three unsolved seams:

Delegation without a live token exchange — how On-Behalf-Of semantics (user token + actor token, scope narrowing per hop) survive being pre-provisioned at deployment instead of negotiated per-request, and what you trade away (revocation latency, replay window) to get there.
Sandboxing on a shared NPU budget — what fuel-metered WASM capability boundaries actually cost when they're competing with your inference pipeline for the same silicon, and where rigor gets traded for a sub-300ms latency budget.