Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MCP is dead?

quandri.io

Post reply on HN
Print view View original

261–270 of 444 posts

Re: MCP is dead?

#261

Post by troupo »

brabel wrote: post #235
geysersam wrote: post #194

Earlier quoted context omitted.

What advantage did you find in MCP vs a traditional API?

No OP, but MCP really is just a logical next step once you've got an API. The API is the "low level" protocol, the MCP is the high level one, suited perfectly to an LLM that can call tools (since MCP essentially turns an API into a LLM tool). With just an API, the agent needs to "read your API docs" to know how to call it (that can be an OpenAPI spec or even just text). With MCP, the agent sees a bunch of tools it ca…

This is a great example of the AI-hype-induced reply.

> to an LLM that can call tools (since MCP essentially turns an API into a LLM tool).

"Tools" is literally an API call

> With MCP, the agent sees a bunch of tools it can call,

Yes, the agent first calls a specific API that returns the schema for that particular server. It's literally the same.

> One more very important factor is authorization, which no one seems to mention in these discussions.

Yes, API calls to services are often gated behind auth. OAuth that MCP uses is from 2006, and its version 2 is from 2012. What do you think it was created for?

> the MCP provider has auditability: is this a call from a human or from a LLM? That's important in Enterprise

We had "differentiate these two accounts and audit log their activity" probably since the 1950s

> there's also more benefits like being able to "elicit" user input

Two-way communication is also a thing since the 1950s, probably.

Re: MCP is dead?

#262

Post by PaulHoule »

v3ss0n wrote: post #252
mrgaro wrote: post #226

Earlier quoted context omitted.

MCP has a great advantage over agent using cli: MCP is much easier to secure so that it's hardwired that the agent can only call the pre-configured MCP server. We run our agents so that they don't have access to public internet, so they could not run any cli commands. It's all either built-in agent tools, or 3rd party mcp servers. The agents never have access to any credentials, which makes them much more safe to use…

How in the world MCP is going to be more secure? It introduce a big surface layers for injection attacks and supply chain attacks..

To be devil’s advocate: if you are just running commands with bash or power shell or the like there is no protection. You might have some rules that ban

rm -rf ~

but sandboxing in general is not an easy problem.

Re: MCP is dead?

#263

Post by cindyllm »

PaulHoule wrote: post #262
v3ss0n wrote: post #252

Earlier quoted context omitted.

How in the world MCP is going to be more secure? It introduce a big surface layers for injection attacks and supply chain attacks..

To be devil’s advocate: if you are just running commands with bash or power shell or the like there is no protection. You might have some rules that ban rm -rf ~ but sandboxing in general is not an easy problem.

[dead]

Re: MCP is dead?

#264

Post by zaphirplane »

zingar wrote: post #249
mrgaro wrote: post #226

Earlier quoted context omitted.

MCP has a great advantage over agent using cli: MCP is much easier to secure so that it's hardwired that the agent can only call the pre-configured MCP server. We run our agents so that they don't have access to public internet, so they could not run any cli commands. It's all either built-in agent tools, or 3rd party mcp servers. The agents never have access to any credentials, which makes them much more safe to use…

Can you not just install/ restrict the available CLIs in the same way you do with MCPs? Or what else am I missing about why MCP is more secure than a CLI?

How do you ensure the cli can use the auth without knowing how to read it ? It’s potentially a bearer Token

Re: MCP is dead?

#265

Post by PaulHoule »

troupo wrote: post #253
Groxx wrote: post #157

Earlier quoted context omitted.

I have some hope that this'll all lead to a revival of semantic web / microformats / etc. Why write an API when you can just add some markup to your existing API, which already looks like stuff that it was trained on, and won't fall out of sync (because you use it too)?

> I have some hope that this'll all lead to a revival of semantic web / microformats / etc Why would it? Do you see any agents or models use that? No, instead vibe coders at Anthropic vibe-designed a bespoke protocol that sidesteps and ignores the last 60 years of API development and integrations.

That was exactly my thought when I saw MCP: like we know so much about creating protocols but get a bunch of people together with no experience and that’s what you get.

Reminds me a lot of Microsoft’s WS-disaster of the early 2000s except the latter was thought through a little better.

To be fair a while back I did design an API for a general purpose model trainer which was absolutely atrocious for a few reasons, my own ignorance was a factor but the problem of accommodating everything from “model that can be trained in 30 seconds on a small machine” to “model that takes 30 days of training on a cluster” problematized it.

It would have made so much more sense to build a standard for documenting ordinary API endpoints and CLIs.

Re: MCP is dead?

#266

Post by miki123211 »

Here's a crazy idea: instead of dealing with MCP servers and distributing all the CLIs for all the platforms, just expose your API... through SSH.

SSH is the perfect protocol for LLMs. Coding agents can use it already, `ssh api@example.com list-users` is all it takes. There's a 90% chance that your users already have ssh installed. It's text-in, text-out (which is exactly what LLMs need). It handles authentication (through public keys), streaming output, interactive I/O, even file transfers (through scp / rsync) if that's something you want.

If your users link their accounts to Github or GitLab, you can even scrape their ssh keys and pre-configure authentication for them, so they just connect and they're in.

Re: MCP is dead?

#267

Post by PaulHoule »

hnlmorg wrote: post #182
tlogan wrote: post #112

Earlier quoted context omitted.

I would bet that MCP is going to die. The main reason is that it adds another layer (and human) that can, and probably will, get out of sync with the real-world implementation, whether that implementation is an API, web, or a CLI. AI should not be using a protocol or set of instructions that is different from what humans have access to (know and use). Sure, companies want to expose MCP servers because it is the cool…

That’s only true for the frontier. The moment you start looking at enterprise consumers of AI you’ll see slow monoliths that make decisions by committee and those committees often don’t even understand the tech they’re passing ruling on. And you’ll also often see CISO-offices that are managed by checklists and yet more committees. Asking for MCP access is generally easier than asking for an API for several reasons: 1…

Explains a lot.

Re: MCP is dead?

#268

Post by PaulHoule »

2muchcoffeeman wrote: post #214
holoduke wrote: post #200

Earlier quoted context omitted.

Funny thing is that Claude knows the api of Atlassian better than the mcp they provide. Mcp is limited it doesn't have all api calls described.

Is this not just a tooling problem?

Yeah, having two tools when you only need one is a problem. Like one is always going to be full phat and the other will ride the back of the bus.

Re: MCP is dead?

#270

Post by PaulHoule »

bluegatty wrote: post #76
ford wrote: post #50

Earlier quoted context omitted.

Basically MCP is little more than a brand name for "APIs LLM's can use". This means more services are creating APIs, because xyz company who's never been super tech forward doesn't want their tools to be obsolete when everyone uses agents. Overall, I am in favor of this goal. I'm not sure this is the protocol I'd choose to accomplish it, but it's the one people hear about, and the one they're using.

"and the one they're using." no it's not. Agents are just making REST calls and that's it. The best thing a company can do to make their stuff 'agent ready' is to make sure the lllm.txt docs are clear-cut and ready for the AI with clear instructions for agentic use. 'MCP' is frankly a hurdle. Now - it probably does make sense to add MCP, because it's not expensive at all, and some will like that use case, it maybe ga…

That mimetic thing…

I remember 10s of HN submissions where handlers were trying to get conversations about MCP going on HN back when there was almost nothing known about it and nothing to say.

It was always about tricking people into thinking there was authentic interest in it and it still is.

Post reply on HN