Well you're not giving the access token to Claude directly. The token is private to the MCP server and Claude uses the server's API, so the server could (should) take measures to prevent things like this from happening. It could notify the user whenever the model tries to write to a public repo and ask for confirmation, for instance.

Probably the only bulletproof measure is to have a completely separate model for each private repo that can only write to its designated private repo, but there are a lot of layers of security one could apply with various tradeoffs