4 ms·

MCP is not an open standard. People routinely mistake "protocol specification uploaded to GitHub, PRs welcome" as open standards. They are not. Calling them "o

MCP is not an open standard. People routinely mistake "protocol specification uploaded to GitHub, PRs welcome" as open standards. They are not. Calling them "open protocols" because they are open source, not open standards (no standards body was involved in the making of this protocol!) is essentially a form of openwashing. This has been happening way too frequently lately (see also: ATProto), and it really needs to be called out.

Toritori12 1y ago
I guess it is a first step... a lot of current "open" protocols started as proprietary.
- croes 1y ago
  The first step should include more security.
nicoburns 1y ago
> no standards body was involved in the making of this protocol! Is a standards body being involved relevant? Many standards ratified by standards bodies are "pay to access" and seem much less open than many de facto standards where no standards body was involved.
- isodev 1y ago
  > Is a standards body being involved relevant? I believe it is. Taking the example of ATproto, it boils down to a managed platform as a service but they seem to do a #BuildInPublic thing where we can experience early developer previews. That’s not really open and it isn’t a standard.
  - philosophty 1y ago
    How are these not "open" if they're GitHub projects and entirely open source and open to outside contribution? The organizations that create "standards" are much less open than this, requiring in person lobbying, schmoozing, travel, and company affiliations.
98codes 1y ago
Open standard or not, how is it a standard at all? I spent a while trying to find what the current version number of the spec is, and I could not find one. Theer were SDKs, and the SDKs have versions, but the protocol itself seems to be on v0.0.0.
- maxwellg 1y ago
  MCP uses a date based system for versioning. The most recent specification is 2025-03-26 - https://modelcontextprotocol.io/specification/2025-03-26 https://modelcontextprotocol.io/specification/2025-03-26
underbluewaters 1y ago
Successful standards usually start out scrappy, are embraced by a community, and then are blessed by standards bodies. What comes out of working groups of standards bodies rarely gains traction. See xhtml vs "html5".
- croes 1y ago
  Does MCP still have the security issues? A big mistake in the first place to start it without proper security. That not Web 2.0 2.0, that‘s Web 1.0
  - doug_durham 1y ago
    It's a mistake to not start at all because of an issue that may not be important for many important use cases.
    - croes 1y ago
      It’s a mistake to start and to think security is a non important issue. Anything that’s connected to the web has to consider security at step one. How often are we repeating the same mistakes over and over again?
    - troupo 1y ago
      It's a mistake to invent your own terminology, skip all existing forms/standards/protocols of communication and chose the objectively worst-fitting one, and skip implementing one of the most fundamental part required by nearly anything
  - jedisct1 1y ago
    MCP Servers are usually installed locally and can do whatever they want on the local machine. But this is solved by sandboxes such as mcp.run .
    - croes 1y ago
      Sandboxes aren’t a solution just a workaround for a bigger problem
sali0 1y ago
Partially agree. But I can't help thinking this is the natural lifecycle of protocols. They first start as open projects, proliferate as such, and evolve into standards with governance once they catch on. What would you call these projects? Open protocols?
dangoor 1y ago
It has become a de facto standard. There are many implementations of MCP. We'll have to see if it fizzles out or if some reasonable stewardship/governance come about, but it is very much possible for something to be a standard even without a standards body.
deleted 1y ago
[deleted]
anildash 1y ago
I was using the phrase in the vernacular sense; I’ve worked on genuine open standards and know the difference. I don’t think it matters that much to use the phrase in this way in an obviously casual piece on my personal blog, as opposed to a more formal assessment of a technology.
deleted 1y ago
[deleted]

Toritori12 1y ago

I guess it is a first step... a lot of current "open" protocols started as proprietary.

croes 1y ago
The first step should include more security.

nicoburns 1y ago

> no standards body was involved in the making of this protocol! Is a standards body being involved relevant? Many standards ratified by standards bodies are "pay to access" and seem much less open than many de facto standards where no standards body was involved.

isodev 1y ago
> Is a standards body being involved relevant? I believe it is. Taking the example of ATproto, it boils down to a managed platform as a service but they seem to do a #BuildInPublic thing where we can experience early developer previews. That’s not really open and it isn’t a standard.
- philosophty 1y ago
  How are these not "open" if they're GitHub projects and entirely open source and open to outside contribution? The organizations that create "standards" are much less open than this, requiring in person lobbying, schmoozing, travel, and company affiliations.

98codes 1y ago

Open standard or not, how is it a standard at all? I spent a while trying to find what the current version number of the spec is, and I could not find one. Theer were SDKs, and the SDKs have versions, but the protocol itself seems to be on v0.0.0.

maxwellg 1y ago
MCP uses a date based system for versioning. The most recent specification is 2025-03-26 - https://modelcontextprotocol.io/specification/2025-03-26 https://modelcontextprotocol.io/specification/2025-03-26

underbluewaters 1y ago

Successful standards usually start out scrappy, are embraced by a community, and then are blessed by standards bodies. What comes out of working groups of standards bodies rarely gains traction. See xhtml vs "html5".

croes 1y ago
Does MCP still have the security issues? A big mistake in the first place to start it without proper security. That not Web 2.0 2.0, that‘s Web 1.0
- doug_durham 1y ago
  It's a mistake to not start at all because of an issue that may not be important for many important use cases.
  - croes 1y ago
    It’s a mistake to start and to think security is a non important issue. Anything that’s connected to the web has to consider security at step one. How often are we repeating the same mistakes over and over again?
  - troupo 1y ago
    It's a mistake to invent your own terminology, skip all existing forms/standards/protocols of communication and chose the objectively worst-fitting one, and skip implementing one of the most fundamental part required by nearly anything
- jedisct1 1y ago
  MCP Servers are usually installed locally and can do whatever they want on the local machine. But this is solved by sandboxes such as mcp.run .
  - croes 1y ago
    Sandboxes aren’t a solution just a workaround for a bigger problem

sali0 1y ago

Partially agree. But I can't help thinking this is the natural lifecycle of protocols. They first start as open projects, proliferate as such, and evolve into standards with governance once they catch on. What would you call these projects? Open protocols?

dangoor 1y ago

It has become a de facto standard. There are many implementations of MCP. We'll have to see if it fizzles out or if some reasonable stewardship/governance come about, but it is very much possible for something to be a standard even without a standards body.

deleted 1y ago

[deleted]

anildash 1y ago

I was using the phrase in the vernacular sense; I’ve worked on genuine open standards and know the difference. I don’t think it matters that much to use the phrase in this way in an obviously casual piece on my personal blog, as opposed to a more formal assessment of a technology.

deleted 1y ago

[deleted]