Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A critical look at MCP

raz.sh

Post reply on HN
Print view View original

221–230 of 348 posts

Re: A critical look at MCP

#221

Post by lolinder »

acchow wrote: post #214
lolinder wrote: post #169

Earlier quoted context omitted.

Unfortunately when someone says "AI" these days they're not talking about pytorch, tensorflow, or numpy. They're talking specifically about LLMs, which are built on top of those tools but which do show the tendency that OP is identifying to generally appear to be vibe-coded over a weekend rather than designed by a rigorous engineering process like what we've come to expect from foundational tech like web browsers or…

Which LLMs seem to be vibe-coded over a weekend? Do you perhaps mean small language models? I doubt Llama or Deepseek were vibe coded..

Sorry, I see that was confusing. I meant tooling for LLMs. Things like Langchain come to mind.

Re: A critical look at MCP

#222

Post by otabdeveloper4 »

jes5199 wrote: post #213
clbrmbr wrote: post #178

Earlier quoted context omitted.

Certainly a shame if true, there are some really sharp folks at Anthropic and this is an important building block in the emerging ecosystem.

someone is going to write an MCP adaptor that lets Claude use OpenAPI and then we can forget that MCP was a thing

This. Endure a couple months and this madness ends.

Re: A critical look at MCP

#223

Post by const_cast »

pixl97 wrote: post #77
neuroelectron wrote: post #44

Earlier quoted context omitted.

The AI houses buying up the entire market of GPUs. Have you heard about them?

This is paranoid drivel.... Tell me which is more likely. 1. There is a cabal of companies painstakingly working together to make the most convoluted software possible from scratch so they can dominate the market. or 2. A few people threw together a bit of code to attempt to get something working without any deep engineering or systematic view of what they were trying to accomplish, getting something to work well eno…

2 works when you're making software, but not when you're making a specification.

The entire point of a specification is that it's well thought out. You SHOULD be considering ways it can be misused, vulnerabilities that might sneak into implementations.

Re: A critical look at MCP

#224

Post by bongodongobob »

punkpeye wrote: post #60

I am the founder of one of the MCP registries ( https://glama.ai/mcp/servers ). I somewhat agree with author’s comments, but also want to note that the protocol is in the extremely early stages of development, and it will likely evolve a lot over the next year. I think that no one (including me) anticipated just how much attention this will get straight out the door. When I started working on the registry, there were…

Then have a convo with all your devs to stop spamming the glory of MCP all over the damn place. Have some patience and finish writing and testing it first.

Re: A critical look at MCP

#225

Post by aristofun »

lispisok wrote: post #204
doug_durham wrote: post #147

Earlier quoted context omitted.

Speak for yourself. I see the majority of work being done by professional software engineers.

"professional software engineer" is a meaningless title because the industry has no professional standards.

That can be a perfect example of kind of mentality that looks prevalent among ai developers - they often are not even aware of the problem.

Re: A critical look at MCP

#226

Post by mrcsharp »

nitely wrote: post #210
mrcsharp wrote: post #202

> "In HTTP+SSE mode, to achieve full duplex, the client sets up an SSE session to (e.g.) GET /sse for reads. The first read provides a URL where writes can be posted. The client then proceeds to use the given endpoint for writes, e.g., a request to POST /a-endpoint?session-id=1234. The server returns a 202 Accepted with no body, and the response to the request should be read from the pre-existing open SSE connection…

> What benefit is SSE providing here? Let the client decide when a session starts/ends by generating IDs and let the server maintain that session internally. The response is generated asynchronously, instead of within the HTTP request/response cycle, and sent over SSE later. But emulating WS with HTTP requests+SSE seems very iffy, indeed.

Well with SSE the server and client are both holding a HTTP connection open for over a relatively long period of time. If the server is written with a language that supports async paradigms, then a http request that needs async IO will use about the same amount of resource anyways. And when the response if finished, that connection is closed and resources are freed. Whereas SSE will keep them for much longer.

Re: A critical look at MCP

#227

Post by ComplexSystems »

fakedang wrote: post #220
ComplexSystems wrote: post #188

Earlier quoted context omitted.

DeepSeek's documentation has a different problem, which is that there are spelling errors and weird grammatical constructions everywhere: "DeepSeek API does NOT constrain user's rate limit. We will try out best to serve every request. However, please note that when our servers are under high traffic pressure, your requests may take some time to receive a response from the server. During this period, your HTTP request…

I've seen documents that were applications by CCP-affiliated provincial government bodies, things like detailed studies for loan applications to international banks, etc. and trust me, the Deepseek documentation is miles ahead of that. These are official government documents from one government agency to some international agency.

This has fascinated me for years. I'll just re-link this comment of mine from a few years ago: https://news.ycombinator.com/item?id=37544019#37548278.

This was about Amazon products rather than government documentation, but the point is the same. I'll just quote the relevant part:

> The people who make these products have to spend millions and millions of dollars setting up factories, hiring people, putting things into production, etc. But somehow they don't have a budget for a bilingual college student intern to translate a bunch of copy to English better than "using this product will bring a great joy." Why?

> I will make a super strong claim: ChatGPT can now do nearly perfect mass translations of this stuff for free, in theory simultaneously increasing translation quality and reducing costs. Despite this, for whatever reason, I predict that the average translation quality on Amazon won't improve within the next few years.

My super strong claim has so far been correct. Just go on Amazon.com and click just about anything. For instance, here's a random blanket: https://www.amazon.com/dp/B07MR4FSPT

"OPTIMUM GIFT: All people can use this flannel fleece blanket in Coach、Office、Bed、Study, etc. Reversible softness offers all seasons warmth. INTIMATE SERVICE: If you have any questions, please contact us. it is our pleasure to serve you."

How does a human being in this situation somehow invent the phrase "OPTIMUM GIFT?" "Optimum" is a fairly advanced English word. Maybe you'd expect, I dunno, "GREAT GIFT" or "BEST GIFT"? And "INTIMATE SERVICE?"

And once again, we now have magic English-speaking computers that can do this all for us - for free - and China has unanimously decided "nah, screw that. We'd rather go with INTIMATE SERVICE."

Re: A critical look at MCP

#228

Post by dend »

lolinder wrote: post #162
dend wrote: post #89

Just to add one piece of clarification - the comment around authorization is a bit out-of-date. We've worked closely with Anthropic and the broader security community to update that part of MCP and implement a proper separation between resource server (RS) and authorization server (AS) when it comes to roles. You can see this spec in draft[1] (it will be there until a new protocol version is ratified). [1]: https://m…

What percentage of the MCP spec is (was?) LLM output? It's setting off all kinds of alarm bells for me, and I'm wondering if I'm on to something or if my LLM-detector alarms are miscalibrated.

Can only speak for the authorization spec, where I am actively participating - zero. The entire spec was written, reviewed, re-written, and edited by real people, with real security backgrounds, without leaning into LLM-based generation.

Re: A critical look at MCP

#229

Post by dend »

vlovich123 wrote: post #155
dend wrote: post #129

Earlier quoted context omitted.

For local servers this doesn't matter as much. For remote servers - you won't really have any serious MCP servers without auth, and you want to have some level setting done between client and servers. OAuth 2.1 is a good middle ground. That's also where, with the new spec, you don't actually need to implement anything from scratch. Server issues a 401 with WWW-Authenticate, pointing to metadata for authorization serv…

Bearer tokens work elsewhere and imho are drastically simpler than oauth

But where would you get bearer tokens? How would you manage consent and scopes? What about revocation? OAuth is essentially the "engine" that gives you the bearer tokens you need for authorization.
Post reply on HN