16 ms·

MCP doesn't need tools, it needs code

228 points by the_mitsuhiko 1y ago

yxhuvud 1y ago
First rule of writing about something that can be abbreviated: First have some explanation so people have an idea of what you are talking about. Either type out what the abbreviation stands for, have an explanation or at least a link to some other page that explain what is going on. EDIT: This has since been fixed in link, so it is outdated.
- diggan 1y ago
  > or at least a link to some other page that explain what is going on There is a link to a previous post by the same author (within the first ten words even!), which contains the context you're looking for.
  - yxhuvud 1y ago
    A link to a previous post is not enough, though of course appreciated. But it would be something I click on after I decide if I should spend time on the article or not. I'm not going on goose chases to figure out what the topic is.
    - dkdcio 1y ago
      this is a wild position. it would have taken you the same amount of time to type your question(s) into your favorite search engine or LLM to learn what the terms mean as you now have spent on this comment thread. the idea that every article should contain all prerequisite knowledge for anybody at any given level of context about any topic is absurd
- reactordev 1y ago
  MCP is Model Context Protocol, welcome to the land of the living. Make sure you turn the lights off to the cave. :) It’s pretty well known by now what MCP stands for, unless you were referring to something else…
  - klez 1y ago
    I, for one, still need to look it up every time I see it mentioned. Not everyone is talking or thinking about LLMs every waking minute.
    - reactordev 1y ago
      I figured with all the AI posts and models, tools, apps, featured on here in the last year or two that it was a given. I guess not.
    - grim_io 1y ago
      Are you looking up what the abbreviation stands for, or what an MCP is? The first case doesn't matter at all if you already know what an MCP actually is. At least for the task of understanding the article.
      - lsaferite 1y ago
        MCP being the initialism for "Model Context Protocol", the specification released by Anthropic, generally dictates you shouldn't say "an MCP" but simply "MCP" or "the MCP". If you are referring to a concrete implementation of a part of MCP, then you likely meant to say "an MCP Server" or "an MCP Client".
  - koakuma-chan 1y ago
    > It’s pretty well known by now what MCP Minecraft Coder Pack https://minecraft.fandom.com/wiki/Tutorials/Programs_and_editors/Mod_Coder_Pack https://minecraft.fandom.com/wiki/Tutorials/Programs_and_edi...
  - tronreference 1y ago
    Master Control Program: https://www.youtube.com/watch?v=atmQjQjoZCQ https://www.youtube.com/watch?v=atmQjQjoZCQ
    - lsaferite 1y ago
      I refuse to believe they didn't name the spec with that in mind. Also... that's some dedication. A user dedicated to a single comment.
- jeroenhd 1y ago
  If you don't know the abbreviation, that can also mean you're not the target audience. This is a blog post written for an audience that uses multiple MCP servers, arguing for a different way to use LLMs. If you need the term explained and don't care enough to throw the abbreviation into Google, you're not going to care much about what's being said anyway. I have no idea what any of the abbreviations in stock market news mean and those stock market people won't know their CLIs from their APIs and LLMs, but that doesn't mean the articles are bad.
- jahsome 1y ago
  Are you referring to MCP? If so, it's fully spelled out in the first sentence of the first paragraph, and links to a more thorough post on the subject. That meets 2 of the 3 criteria you've dictated.
  - yxhuvud 1y ago
    That was not the case when I commented. It has obviously been updated since then.
    - jahsome 1y ago
      Assuming that's true, how would it be obvious to someone who hadn't seen the original?
- losvedir 1y ago
  If you don't know what "MCP" stands for, then this article isn't for you. It's okay to load it, realize you're not the target audience, and move on. Or, spend some of your own time looking it up. This is like complaining that HTTP or API isn't explained.
  - mattacular 1y ago
    It's not really like your examples because MCP has been around for about 1 year whereas those others have been around for decades and are completely ubiquitous throughout the software industry as a result.
  - AznHisoka 1y ago
    The difference is those terms are ubiquitous terms after 20 years of usage. MCP is a relatively new term that hasnt even been around for a year or so
  - DrewADesign 1y ago
    I think this issue seems completely straightforward to many people… and their answer likely depends on if they know what MCP means. The balance isn’t really clear cut. On one hand, MCP isn’t ubiquitous like, say, DNS or ancient like BSD. On the other, technical audiences can be expected to look up terms that are new to them. The point of a headline is to offer a terse summary, not an explanation, and adding three full words makes it less useful. However, that summary isn’t particularly useful if readers don’t know what the hell you’re talking about, either, and using jargon nearly guarantees that. I think it’s just one of those damned-if-you-do/don’t situations.
  - bityard 1y ago
    Textbook example of gatekeeping if I ever saw it.
- cgriswald 1y ago
  Just so folks who want to do this know, the proper way to introduce an initialism is to use the full term on first use and put the initialism in parentheses. Thereafter just use the initialism. Always consider your audience, but for most non-casual writing it’s a good default for a variety of reasons.
  - mdaniel 1y ago
    You're welcome to do that in print media, but on the web the proper way is the abbr element with its title attribute <https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/abbr https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/...>. Related to the distinction, I'd bet $1 there's some fancy CSS that would actually expand the definition under @media print I can attest the abbr is also mobile friendly, although I am for sure open to each browser doing its own UI hinting that a long-press is available for the term
    - cgriswald 1y ago
      From your source: > Spelling out the acronym or abbreviation in full the first time it is used on a page is beneficial for helping people understand it, especially if the content is technical or industry jargon. > Only include a title if expanding the abbreviation or acronym in the text is not possible. Having a difference between the announced word or phrase and what is displayed on the screen, especially if it's technical jargon the reader may not be familiar with, can be jarring.
    - crazygringo 1y ago
      Please read your own link. It literally says to put the definition in parentheses (same as print) on first use. Second paragraph. <abbr> is not what you seem to think it is. But the "typical use cases" section of your link does explain what it's actually for.
    - jethack 1y ago
      Sadly abbr with title doesn't work at all on mobile Chrome [1] or Firefox [2]. Probably not Safari either, since long press on mobile means "select text" so you'd have to do some CSS trickery (and trying to hit a word-sized target with a finger is quite annoying). [1] https://issues.chromium.org/issues/337222647 https://issues.chromium.org/issues/337222647 -> https://issues.chromium.org/issues/41130053 https://issues.chromium.org/issues/41130053 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1468007 https://bugzilla.mozilla.org/show_bug.cgi?id=1468007
- bgwalter 1y ago
  "MCP" is the new "webscale". It can be used to write philosophical papers about LLMs orchestrating the obliquely owned ontologies of industrial systems, including SCADA systems: https://arxiv.org/html/2506.11180v1 https://arxiv.org/html/2506.11180v1 SCADA systems got famous, because they previously required STUXNET to be hacked. In the future you can just vibe hack them.
- owebmaster 1y ago
  If you are looking for a definition, you should go for beginners article, not advanced.
xavierx 1y ago
Is this just code injection? It’s talking about passing Python code in that would have a Python interpreter tool. Even if you had guardrails setup that seems a little chancery, but hey this is the time of development evolution where we’re letting AI write code anyway, so why not give other people remote code execution access, because fuck it all.
- laser_eagle 1y ago
  [dead]
- thrown-0825 1y ago
  yes, modern development practice is to introduce rce’s as a feature and then fund raise around it.
preek 1y ago
Re Security: I put my AI assistant in a sandbox. There, it can do whatever it wants, including deleting or mutating anything that would otherwise be harmful. I wrote about how to do it with Guix: https://200ok.ch/posts/2025-05-23_sandboxing_ai_tools:_how_guix_containers_keep_your_host_safe_while_empowering_llms.html https://200ok.ch/posts/2025-05-23_sandboxing_ai_tools:_how_g... Since then, I have switched to using Bubblewrap: https://github.com/munen/dotfiles/blob/master/bin/bin/bubblewrap-container https://github.com/munen/dotfiles/blob/master/bin/bin/bubble...
philipp-gayret 1y ago
Agree on that it should be composable. Even better if MCP tooling wouldn't yield huge amounts of output that pollutes the context and the output of one can be input to the next, so indeed that may as well be code. Would be nice if there was a way for agents to work with MCPs as code, preview or debug the data flowing through them. At the moment it all seems not a mature enough solution and Id rather mount a Python sandbox with API keys to what it needs than connect an MCP tool on my own machine.
- thrown-0825 1y ago
  MCP defeats the entire point of LLMs.
juanviera23 1y ago
I agree MCP has these flaws, idk why we need MCP servers when LLMs can just connect to the existing API endpoint Started on working on an alternative protocol, which lets agents call native endpoints directly (HTTP/CLI/WebSocket) via “manuals” and “providers,” instead of spinning up a bespoke wrapper server: https://github.com/universal-tool-calling-protocol/python-utcp https://github.com/universal-tool-calling-protocol/python-ut... even connects to MCP servers if you take a look, would love your thoughts
- rco8786 1y ago
  > when LLMs can just connect to the existing API endpoint The primary differentiator is that MCP includes endpoint discovery. You tell the LLM about the general location of the MCP tool, and it can figure out what capabilities that tool offers immediately. And when the tool updates, the LLM instantly re-learns the updated capability. The rest of it is needlessly complicated (IMO) and could just be a bog standard HTTP API. And this is what every MCP server I've encountered so far actually does, I haven't seen anyone use the various SSE functionality and whatnot. MCP v.01 (current) is both a step in the right direction (capability discovery) and an awkward misstep on what should have been the easy part (the API structure itself)
  - AznHisoka 1y ago
    How is this different than just giving the LLM an OpenAI spec in the prompt? Does it somehow get around the huge amount of input tokens that would require?
    - stanleydrew 1y ago
      Technically it's not really much different from just giving the LLM an OpenAPI spec. The actual thing that's different is that an OpenAPI spec is meant to be an exhaustive list of every endpoint and every parameter you could ever use. Whereas an MCP server, as a proxy to an API, tends to offer a curated set of tools and might even compose multiple API calls into a single tool.
faangguyindia 1y ago
Here is why MCP is bad, here i am trying to use MCP to build a simple node cli tool to fetch documentation from Context7: https://pastebin.com/raw/b4itvBu4 https://pastebin.com/raw/b4itvBu4 And it doesn't work even after 10 attemps. Fails and i've no idea why, meanwhile python code works without issues but i can't use that one as it conflicts with existing dependencies in aider, see: https://pastebin.com/TNpMRsb9 https://pastebin.com/TNpMRsb9 (working code after 5 failed attempts) I am never gonna bother with this again, it can be built as a simple rest API, why we even need this ugly protocol?
- coverj 1y ago
  I'm interested why you aren't using the actual context7 MCP?
  - the_mitsuhiko 1y ago
    He is if you look at the code. From my experience context7 just does not work, or at least does not help. I did plenty of experiments with it and that approach just does not go anywhere with the tools and models available today.
CharlieDigital 1y ago
A few weeks back, I actually started working on an MCP server that is designed to let the LLM generate and execute JavaScript in a safe, sandboxed C# runtime with Jint as the interpreter. https://github.com/CharlieDigital/runjs https://github.com/CharlieDigital/runjs Lets the LLM safely generate and execute whatever code it needs. Bounded by statement count, memory limits, and runtime limits. It has a built in secrets manager API (so generated code can make use of remote APIs) can, HTTP fetch analogue, JSONPath for JSON handling, and Polly for HTTP request resiliency.
- mdaniel 1y ago
  I don't meant to throw shade on your toy, but trying to get a prediction model to use a language that actively hates developers is a real roll-the-dice outcome
  - CharlieDigital 1y ago
    Which language? C# or JS? OpenAI and Claude are quite good at JS. The runtime is C# to sandbox the execution so it is not being generated.
jumploops 1y ago
The promise of MCP is that it “connects your models with the world”[0]. In my experience, it’s actually quite the opposite. By giving an LLM a set of tools, 30 in the Playwright case from the article, you’re essentially restricting what it can do. In this sense, MCP is more of a guardrail/sandbox for an LLM, rather than a superpower (you must choose one of these Stripe commands!). This is good for some cases, where you want your “agent”[1] to have exactly some subset of tools, similar to a line worker or specialist. However it’s not so great when you’re using the LLM as a companion/pair programmer for some task, where you want its output to be truly unbounded. [0]https://modelcontextprotocol.io/docs/getting-started/intro https://modelcontextprotocol.io/docs/getting-started/intro [1]For these cases you probably shouldn’t use MCP, but instead define tools explicitly within one context.
- nsonha 1y ago
  It's not guardrail, it's guidance. You don't guide a child or an intern with: "here is everything under the sun, just do things", you give them a framework, programming language, or general direction to operate within.
  - nativeit 1y ago
    Interns and children didn’t cost $500B.
    - nsonha 1y ago
      Some of them quip on HN, quite impressive.
    - Bjartr 1y ago
      Collectively they kind of do and then some. That cost for AI is in aggregate, so really it should be compared to the cost of living + raising children to be educated and become interns. At some point the hope for both is that they result in a net benefit society.
    - senko 1y ago
      How is that relevant?
evrennetwork 1y ago
[dead]
abtinf 1y ago
I’ve posted this before[1], and have searched, but still haven’t found it: I wish someone would write a clear, crisp explanation for why MCP is needed over simply supporting swagger or proto/grpc. [1] https://news.ycombinator.com/item?id=44848489 https://news.ycombinator.com/item?id=44848489
- avereveard 1y ago
  Think a LLM driving a Browser, where it fills field, click things, and in general where losing the state loses the work done so far That's the C in the protocol. Sure you can add a session key to the swagger api and expose it that way so that llm can continue their conversation, but it's going to be a fragile integration at best. A MCP tied to the conversation state abstract all that away, for better or worse.
- aszen 1y ago
  I'll give you one simple reason, APIs designed for machines are not suitable for LLMs to use consistently. Llms need a carefully designed interface which exposes tools at the intent level, most APIs are too low level for llms to perform user actions in a single call.
s1mplicissimus 1y ago
I tried doing the MCP approach with about 100 tools, but the agent picks the wrong tool a lot of the time and it seems to have gotten significantly worse the more tools I added. Any ideas how to deal with this? Is it one of those unsolvable XOR-like problems maybe?
- laser_eagle 1y ago
  [dead]
- throwaway314155 1y ago
  You wind up having to explicitly tell it to use a tool and how to use it (defeating the point, mostly)
- the_mitsuhiko 1y ago
  Remove most tools. After 30 tools it greatly regresses.
- lsaferite 1y ago
  There are many routes to a solution. Two options (out of multiple): - Have sub-agents with different subsets of tools. The main agent then delegates. - Have dedicated tools that let the main agent activate subsets of tools as needed.
- faangguyindia 1y ago
  AI agents can't even remember which files are already in the context, let alone them picking right tool for the job.
- thrown-0825 1y ago
  congrats, you have encountered one of the fundamental flaws of using an ad-lib generator as an orchestration / rules engine.
laser_eagle 1y ago
[dead]
skerit 1y ago
I don't get it. Tools are a way to let LLMs do something via what is essentially an API. Is it limited? Yes, it is. By design. Sure in some cases it might be overkill and letting the assistant write & execute plain code might be best. There are plenty of silly MCP servers out there.
scosman 1y ago
I made a MCP server that tries to address some of these (undocumented, security, discoverability, platform specific). You write a yaml describing your tools (lint/format/test/build), and it exposes them to agents MCP. Kinda like package.json scripts but for agents. Speeds things up too, fewer incorrect commands, no human approval needed, and parallel execution. https://github.com/scosman/hooks_mcp https://github.com/scosman/hooks_mcp The interactive lldb session here is super cool for deeper debugging. For security, containers seem like the solution - sketch.dev is my fav take on containerizing agents at the moment.
giltho 1y ago
Imagine 50 years of computer security to have articles come up on hackernews saying “what you need is to allow a black box to run arbitrary python code” :(
- thrown-0825 1y ago
  from user input lmao these people are not to be taken seriously
PhilipRoman 1y ago
Can't wait until I can buy a H100 with a DisplayPort input and USB keyboard and mouse output and just let it figure everything out.
- mdaniel 1y ago
  I'm guessing I'm spoiling the joke, but why not just a Thunderbolt dock and plug the H100 into your existing machine, no DisplayPort interpretation required? Although I could easily imagine the external robot(?) being a "hold my beer" to the interview cheat arms race To extra ruin the joke, the 96GB versions seem to be going for $24,000 on ebay right now
- thrown-0825 1y ago
  In a couple years you will be able to get used ones on ebay for cheap, I cant wait.
kordlessagain 1y ago
As one does, I've built an alternative to MCP: https://ahp.nuts.services https://ahp.nuts.services Put GPT5 into agent mode then give it that URL and the token 'linkedinPROMO1' and once it loads the tools tell it to use curl in a terminal (it's faster) and then run the random tool. This is authenticated at the moment with that token, plus bearer tokens, but I've got the new auth system up and its working. I still have to do the integration with all the other services (the website, auth, AHP and the crawler and OCR engine), so will be a while before all that's done.
xmorse 1y ago
This is how tools are implemented in latest Gemini models like gemini-2.5-flash-preview-native-audio-dialog: the LLM has access to a code execution tool that can run code in python and all tools are available in a default_api class
sam0x17 1y ago
Yeah I quite agree with this take. I don't understand why editors aren't utilizing language servers more for making changes. Crazy to see agents running grep and sed and awk and stuff, all of that should be provided through a very efficient cursor-based interface by the editor itself. And for most languages, they shouldn't even be operating on strings, they should be operating on token streams and ASTs
- spacebanana7 1y ago
  It's so weird that codex/claude code will manually read through sometimes dozens of files in a project because they have no easy way to ask the editor to "Find Usages". Even though efficient use of CLI tools might make the token burn not too bad, the models will still need to spent extra effort thinking about references in comments, readmes, and method overloading.
  - ctoth 1y ago
    Which is why I wrote a code extractor MCP which uses Tree-sitter -- surely something that directly connects MCP with LSP would be better but the one bridge layer I found for that seemed unmaintained. I don't love my implementation which is why I'm not linking to it.
    - tough 1y ago
      both opencode and charm's crush support LSP's and MCP's as configs
  - doikor 1y ago
    We have that in Scala with the MCP tools metals provides but convincing Claude to actually use the tools has been really painful. https://scalameta.org/metals/blog/2025/05/13/strontium/#mcp-support https://scalameta.org/metals/blog/2025/05/13/strontium/#mcp-...
  - fzzzy 1y ago
    Really? Github Copilot Agent can search. Interesting.
BLanen 1y ago
What this is saying is again, that MCP is not a protocol. Which is the point of MCP, making it essentially worthless because it doesn't define actual behavioral rules, it can only describe existing rules informally. This is because defining a formal system, that can do everything MCP promises to enable, is a logical impossibility.
larve 1y ago
codeact is a really interesting area to explore. I expanded upon the JS platform I started sketching out in https://www.youtube.com/watch?v=J3oJqan2Gv8 https://www.youtube.com/watch?v=J3oJqan2Gv8 . LLMs know a million APIs out of the box and have no trouble picking more up through context, yet struggle once you give them a few tools. In fact just enabling a single tool definition "degrades" the vibes of the model. Give them an eval() with a couple of useful libraries (say, treesitter), and they are able not only to use it well, but to write their own "tools" (functions) and save massively on tokens. They also allow you to build "ephemeral" apps, because who wants to wait for tokens to stream and a LLM to interpret the result when you could do most tasks with a normal UI, only jumping into the LLM when fuzziness is required. Most of my work on this is sadly private right now, but here's a few repos github.com/go-go-golems/jesus https://github.com/go-go-golems/go-go-goja https://github.com/go-go-golems/go-go-goja that are the foundation.
turnsout 1y ago
> One surprisingly useful way of running an MCP server is to make it an MCP server with a single tool (the ubertool) which is just a Python interpreter that runs eval() with retained state. Wow, you better be sure you have that Python environment locked down.
- starkparker 1y ago
  yeah, check out the article's "Security is a Sham" heading that explicitly covers why the author doesn't really give a shit
  - turnsout 1y ago
    Yeah, I saw that, it's still just wild. I guess "YOLO" is one response to the difficulties of securing endpoints.
throwmeaway222 1y ago
problem with MCP right now is that LLMs don't natively know what it is an LLM natively knows bash and how to run things MCP is forcing a weird set of non-normal rules that most of the writing of the web doesn't support. Most of the web writes a lot about bash and getting things done. Maybe in a few years LLMs will "natively" understand them, but I see MCP more as a buzzword right now.
- dragonwriter 1y ago
  > problem with MCP right now is that LLMs don't natively know what it is Most models that it is used with natively know what tools are (they are trained with particular prompt formats for the use of arbitrary tools), and the model never sees MCP at all, it just sees tool definitions, or tool responses, in the format it expects in prompts. MCPs are a way to communicate information about tools to the toolchain running the LLM, when the LLM sees information that came via MCP it is indistinguishable from tools that might be built into the toolchain or provided by another mechanism.
  - throwmeaway222 1y ago
    No that's not what I'm saying. If you tell an LLM that you need a report on a specific member of congress and provide a prompt saying you can use bash tools like grep/curl/ping/git/etc... just return bash then a formatted code block Or you can use fetch_record followed by a formatted code block of the name of a google search you want to perform. The LLM will likely use bash and curl because it NATIVELY knows what it is and is capable of, while this other tool you have to feed it all these parameters that it is not used to. I'm not saying go ahead and throw that in chatgpt, I'm talking from experience at our company using MCP vs bashable stuff, it keeps ignoring the other tools.
    - dragonwriter 1y ago
      It's possible that its not about "native knowledge" but about how the descriptions (which get mapped into the prompt) for each of the tools are setup (or even their order; LLM behavior can be very sensitive to not-obviously-important prompt differences.) I'd be cautious inferring generalizations about behavior and then explanations of those generalizations from observation of a particular LLM used via a particular toolchain. That said, that it does that in that environment is still an interesting observation.
PhilKunz 1y ago
How come noone mentioned serena MCP here until now :D
ryukafalz 1y ago
As ever, I think the answer to "how do we sandbox arbitrary code while still letting it do useful things?", whether human-written or machine-written, is with object capabilities. Run the generated code in a sandbox, but pass in capabilities to useful resources, whether that be remote servers, local directories, or whatever else. Then you know the bounds of what trouble it can get up to from the start.
pploug 1y ago
While I generally agree with the author on code over tools, the article could have benefitted from some concrete ways that this could have potentially been done somewhat securely by sandboxing, enforcing zero trust, network segmentation, and all the other known controls we've developed over the last decade. I love the optimism of this space, but fear that the "security is a sham" attitude will bite us all in the ass down the line.

228 points by the_mitsuhiko 1y ago

First rule of writing about something that can be abbreviated: First have some explanation so people have an idea of what you are talking about. Either type out what the abbreviation stands for, have an explanation or at least a link to some other page that explain what is going on. EDIT: This has since been fixed in link, so it is outdated.

diggan 1y ago
> or at least a link to some other page that explain what is going on There is a link to a previous post by the same author (within the first ten words even!), which contains the context you're looking for.
- yxhuvud 1y ago
  A link to a previous post is not enough, though of course appreciated. But it would be something I click on after I decide if I should spend time on the article or not. I'm not going on goose chases to figure out what the topic is.
  - dkdcio 1y ago
    this is a wild position. it would have taken you the same amount of time to type your question(s) into your favorite search engine or LLM to learn what the terms mean as you now have spent on this comment thread. the idea that every article should contain all prerequisite knowledge for anybody at any given level of context about any topic is absurd
reactordev 1y ago
MCP is Model Context Protocol, welcome to the land of the living. Make sure you turn the lights off to the cave. :) It’s pretty well known by now what MCP stands for, unless you were referring to something else…
- klez 1y ago
  I, for one, still need to look it up every time I see it mentioned. Not everyone is talking or thinking about LLMs every waking minute.
  - reactordev 1y ago
    I figured with all the AI posts and models, tools, apps, featured on here in the last year or two that it was a given. I guess not.
  - grim_io 1y ago
    Are you looking up what the abbreviation stands for, or what an MCP is? The first case doesn't matter at all if you already know what an MCP actually is. At least for the task of understanding the article.
    - lsaferite 1y ago
      MCP being the initialism for "Model Context Protocol", the specification released by Anthropic, generally dictates you shouldn't say "an MCP" but simply "MCP" or "the MCP". If you are referring to a concrete implementation of a part of MCP, then you likely meant to say "an MCP Server" or "an MCP Client".
- koakuma-chan 1y ago
  > It’s pretty well known by now what MCP Minecraft Coder Pack https://minecraft.fandom.com/wiki/Tutorials/Programs_and_editors/Mod_Coder_Pack https://minecraft.fandom.com/wiki/Tutorials/Programs_and_edi...
- tronreference 1y ago
  Master Control Program: https://www.youtube.com/watch?v=atmQjQjoZCQ https://www.youtube.com/watch?v=atmQjQjoZCQ
  - lsaferite 1y ago
    I refuse to believe they didn't name the spec with that in mind. Also... that's some dedication. A user dedicated to a single comment.
jeroenhd 1y ago
If you don't know the abbreviation, that can also mean you're not the target audience. This is a blog post written for an audience that uses multiple MCP servers, arguing for a different way to use LLMs. If you need the term explained and don't care enough to throw the abbreviation into Google, you're not going to care much about what's being said anyway. I have no idea what any of the abbreviations in stock market news mean and those stock market people won't know their CLIs from their APIs and LLMs, but that doesn't mean the articles are bad.
jahsome 1y ago
Are you referring to MCP? If so, it's fully spelled out in the first sentence of the first paragraph, and links to a more thorough post on the subject. That meets 2 of the 3 criteria you've dictated.
- yxhuvud 1y ago
  That was not the case when I commented. It has obviously been updated since then.
  - jahsome 1y ago
    Assuming that's true, how would it be obvious to someone who hadn't seen the original?
losvedir 1y ago
If you don't know what "MCP" stands for, then this article isn't for you. It's okay to load it, realize you're not the target audience, and move on. Or, spend some of your own time looking it up. This is like complaining that HTTP or API isn't explained.
- mattacular 1y ago
  It's not really like your examples because MCP has been around for about 1 year whereas those others have been around for decades and are completely ubiquitous throughout the software industry as a result.
- AznHisoka 1y ago
  The difference is those terms are ubiquitous terms after 20 years of usage. MCP is a relatively new term that hasnt even been around for a year or so
- DrewADesign 1y ago
  I think this issue seems completely straightforward to many people… and their answer likely depends on if they know what MCP means. The balance isn’t really clear cut. On one hand, MCP isn’t ubiquitous like, say, DNS or ancient like BSD. On the other, technical audiences can be expected to look up terms that are new to them. The point of a headline is to offer a terse summary, not an explanation, and adding three full words makes it less useful. However, that summary isn’t particularly useful if readers don’t know what the hell you’re talking about, either, and using jargon nearly guarantees that. I think it’s just one of those damned-if-you-do/don’t situations.
- bityard 1y ago
  Textbook example of gatekeeping if I ever saw it.
cgriswald 1y ago
Just so folks who want to do this know, the proper way to introduce an initialism is to use the full term on first use and put the initialism in parentheses. Thereafter just use the initialism. Always consider your audience, but for most non-casual writing it’s a good default for a variety of reasons.
- mdaniel 1y ago
  You're welcome to do that in print media, but on the web the proper way is the abbr element with its title attribute <https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/abbr https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/...>. Related to the distinction, I'd bet $1 there's some fancy CSS that would actually expand the definition under @media print I can attest the abbr is also mobile friendly, although I am for sure open to each browser doing its own UI hinting that a long-press is available for the term
  - cgriswald 1y ago
    From your source: > Spelling out the acronym or abbreviation in full the first time it is used on a page is beneficial for helping people understand it, especially if the content is technical or industry jargon. > Only include a title if expanding the abbreviation or acronym in the text is not possible. Having a difference between the announced word or phrase and what is displayed on the screen, especially if it's technical jargon the reader may not be familiar with, can be jarring.
  - crazygringo 1y ago
    Please read your own link. It literally says to put the definition in parentheses (same as print) on first use. Second paragraph. <abbr> is not what you seem to think it is. But the "typical use cases" section of your link does explain what it's actually for.
  - jethack 1y ago
    Sadly abbr with title doesn't work at all on mobile Chrome [1] or Firefox [2]. Probably not Safari either, since long press on mobile means "select text" so you'd have to do some CSS trickery (and trying to hit a word-sized target with a finger is quite annoying). [1] https://issues.chromium.org/issues/337222647 https://issues.chromium.org/issues/337222647 -> https://issues.chromium.org/issues/41130053 https://issues.chromium.org/issues/41130053 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1468007 https://bugzilla.mozilla.org/show_bug.cgi?id=1468007
bgwalter 1y ago
"MCP" is the new "webscale". It can be used to write philosophical papers about LLMs orchestrating the obliquely owned ontologies of industrial systems, including SCADA systems: https://arxiv.org/html/2506.11180v1 https://arxiv.org/html/2506.11180v1 SCADA systems got famous, because they previously required STUXNET to be hacked. In the future you can just vibe hack them.
owebmaster 1y ago
If you are looking for a definition, you should go for beginners article, not advanced.

xavierx 1y ago

Is this just code injection? It’s talking about passing Python code in that would have a Python interpreter tool. Even if you had guardrails setup that seems a little chancery, but hey this is the time of development evolution where we’re letting AI write code anyway, so why not give other people remote code execution access, because fuck it all.

laser_eagle 1y ago
[dead]
thrown-0825 1y ago
yes, modern development practice is to introduce rce’s as a feature and then fund raise around it.

preek 1y ago

Re Security: I put my AI assistant in a sandbox. There, it can do whatever it wants, including deleting or mutating anything that would otherwise be harmful. I wrote about how to do it with Guix: https://200ok.ch/posts/2025-05-23_sandboxing_ai_tools:_how_guix_containers_keep_your_host_safe_while_empowering_llms.html https://200ok.ch/posts/2025-05-23_sandboxing_ai_tools:_how_g... Since then, I have switched to using Bubblewrap: https://github.com/munen/dotfiles/blob/master/bin/bin/bubblewrap-container https://github.com/munen/dotfiles/blob/master/bin/bin/bubble...

philipp-gayret 1y ago

Agree on that it should be composable. Even better if MCP tooling wouldn't yield huge amounts of output that pollutes the context and the output of one can be input to the next, so indeed that may as well be code. Would be nice if there was a way for agents to work with MCPs as code, preview or debug the data flowing through them. At the moment it all seems not a mature enough solution and Id rather mount a Python sandbox with API keys to what it needs than connect an MCP tool on my own machine.

thrown-0825 1y ago
MCP defeats the entire point of LLMs.

juanviera23 1y ago

I agree MCP has these flaws, idk why we need MCP servers when LLMs can just connect to the existing API endpoint Started on working on an alternative protocol, which lets agents call native endpoints directly (HTTP/CLI/WebSocket) via “manuals” and “providers,” instead of spinning up a bespoke wrapper server: https://github.com/universal-tool-calling-protocol/python-utcp https://github.com/universal-tool-calling-protocol/python-ut... even connects to MCP servers if you take a look, would love your thoughts

rco8786 1y ago
> when LLMs can just connect to the existing API endpoint The primary differentiator is that MCP includes endpoint discovery. You tell the LLM about the general location of the MCP tool, and it can figure out what capabilities that tool offers immediately. And when the tool updates, the LLM instantly re-learns the updated capability. The rest of it is needlessly complicated (IMO) and could just be a bog standard HTTP API. And this is what every MCP server I've encountered so far actually does, I haven't seen anyone use the various SSE functionality and whatnot. MCP v.01 (current) is both a step in the right direction (capability discovery) and an awkward misstep on what should have been the easy part (the API structure itself)
- AznHisoka 1y ago
  How is this different than just giving the LLM an OpenAI spec in the prompt? Does it somehow get around the huge amount of input tokens that would require?
  - stanleydrew 1y ago
    Technically it's not really much different from just giving the LLM an OpenAPI spec. The actual thing that's different is that an OpenAPI spec is meant to be an exhaustive list of every endpoint and every parameter you could ever use. Whereas an MCP server, as a proxy to an API, tends to offer a curated set of tools and might even compose multiple API calls into a single tool.

faangguyindia 1y ago

Here is why MCP is bad, here i am trying to use MCP to build a simple node cli tool to fetch documentation from Context7: https://pastebin.com/raw/b4itvBu4 https://pastebin.com/raw/b4itvBu4 And it doesn't work even after 10 attemps. Fails and i've no idea why, meanwhile python code works without issues but i can't use that one as it conflicts with existing dependencies in aider, see: https://pastebin.com/TNpMRsb9 https://pastebin.com/TNpMRsb9 (working code after 5 failed attempts) I am never gonna bother with this again, it can be built as a simple rest API, why we even need this ugly protocol?

coverj 1y ago
I'm interested why you aren't using the actual context7 MCP?
- the_mitsuhiko 1y ago
  He is if you look at the code. From my experience context7 just does not work, or at least does not help. I did plenty of experiments with it and that approach just does not go anywhere with the tools and models available today.

CharlieDigital 1y ago

A few weeks back, I actually started working on an MCP server that is designed to let the LLM generate and execute JavaScript in a safe, sandboxed C# runtime with Jint as the interpreter. https://github.com/CharlieDigital/runjs https://github.com/CharlieDigital/runjs Lets the LLM safely generate and execute whatever code it needs. Bounded by statement count, memory limits, and runtime limits. It has a built in secrets manager API (so generated code can make use of remote APIs) can, HTTP fetch analogue, JSONPath for JSON handling, and Polly for HTTP request resiliency.

mdaniel 1y ago
I don't meant to throw shade on your toy, but trying to get a prediction model to use a language that actively hates developers is a real roll-the-dice outcome
- CharlieDigital 1y ago
  Which language? C# or JS? OpenAI and Claude are quite good at JS. The runtime is C# to sandbox the execution so it is not being generated.

jumploops 1y ago

The promise of MCP is that it “connects your models with the world”[0]. In my experience, it’s actually quite the opposite. By giving an LLM a set of tools, 30 in the Playwright case from the article, you’re essentially restricting what it can do. In this sense, MCP is more of a guardrail/sandbox for an LLM, rather than a superpower (you must choose one of these Stripe commands!). This is good for some cases, where you want your “agent”[1] to have exactly some subset of tools, similar to a line worker or specialist. However it’s not so great when you’re using the LLM as a companion/pair programmer for some task, where you want its output to be truly unbounded. [0]https://modelcontextprotocol.io/docs/getting-started/intro https://modelcontextprotocol.io/docs/getting-started/intro [1]For these cases you probably shouldn’t use MCP, but instead define tools explicitly within one context.

nsonha 1y ago
It's not guardrail, it's guidance. You don't guide a child or an intern with: "here is everything under the sun, just do things", you give them a framework, programming language, or general direction to operate within.
- nativeit 1y ago
  Interns and children didn’t cost $500B.
  - nsonha 1y ago
    Some of them quip on HN, quite impressive.
  - Bjartr 1y ago
    Collectively they kind of do and then some. That cost for AI is in aggregate, so really it should be compared to the cost of living + raising children to be educated and become interns. At some point the hope for both is that they result in a net benefit society.
  - senko 1y ago
    How is that relevant?

evrennetwork 1y ago

[dead]

abtinf 1y ago

I’ve posted this before[1], and have searched, but still haven’t found it: I wish someone would write a clear, crisp explanation for why MCP is needed over simply supporting swagger or proto/grpc. [1] https://news.ycombinator.com/item?id=44848489 https://news.ycombinator.com/item?id=44848489

avereveard 1y ago
Think a LLM driving a Browser, where it fills field, click things, and in general where losing the state loses the work done so far That's the C in the protocol. Sure you can add a session key to the swagger api and expose it that way so that llm can continue their conversation, but it's going to be a fragile integration at best. A MCP tied to the conversation state abstract all that away, for better or worse.
aszen 1y ago
I'll give you one simple reason, APIs designed for machines are not suitable for LLMs to use consistently. Llms need a carefully designed interface which exposes tools at the intent level, most APIs are too low level for llms to perform user actions in a single call.

s1mplicissimus 1y ago

I tried doing the MCP approach with about 100 tools, but the agent picks the wrong tool a lot of the time and it seems to have gotten significantly worse the more tools I added. Any ideas how to deal with this? Is it one of those unsolvable XOR-like problems maybe?

laser_eagle 1y ago
[dead]
throwaway314155 1y ago
You wind up having to explicitly tell it to use a tool and how to use it (defeating the point, mostly)
the_mitsuhiko 1y ago
Remove most tools. After 30 tools it greatly regresses.
lsaferite 1y ago
There are many routes to a solution. Two options (out of multiple): - Have sub-agents with different subsets of tools. The main agent then delegates. - Have dedicated tools that let the main agent activate subsets of tools as needed.
faangguyindia 1y ago
AI agents can't even remember which files are already in the context, let alone them picking right tool for the job.
thrown-0825 1y ago
congrats, you have encountered one of the fundamental flaws of using an ad-lib generator as an orchestration / rules engine.

laser_eagle 1y ago

[dead]

skerit 1y ago

I don't get it. Tools are a way to let LLMs do something via what is essentially an API. Is it limited? Yes, it is. By design. Sure in some cases it might be overkill and letting the assistant write & execute plain code might be best. There are plenty of silly MCP servers out there.

scosman 1y ago

I made a MCP server that tries to address some of these (undocumented, security, discoverability, platform specific). You write a yaml describing your tools (lint/format/test/build), and it exposes them to agents MCP. Kinda like package.json scripts but for agents. Speeds things up too, fewer incorrect commands, no human approval needed, and parallel execution. https://github.com/scosman/hooks_mcp https://github.com/scosman/hooks_mcp The interactive lldb session here is super cool for deeper debugging. For security, containers seem like the solution - sketch.dev is my fav take on containerizing agents at the moment.

giltho 1y ago

Imagine 50 years of computer security to have articles come up on hackernews saying “what you need is to allow a black box to run arbitrary python code” :(

thrown-0825 1y ago
from user input lmao these people are not to be taken seriously

PhilipRoman 1y ago

Can't wait until I can buy a H100 with a DisplayPort input and USB keyboard and mouse output and just let it figure everything out.

mdaniel 1y ago
I'm guessing I'm spoiling the joke, but why not just a Thunderbolt dock and plug the H100 into your existing machine, no DisplayPort interpretation required? Although I could easily imagine the external robot(?) being a "hold my beer" to the interview cheat arms race To extra ruin the joke, the 96GB versions seem to be going for $24,000 on ebay right now
thrown-0825 1y ago
In a couple years you will be able to get used ones on ebay for cheap, I cant wait.

kordlessagain 1y ago

As one does, I've built an alternative to MCP: https://ahp.nuts.services https://ahp.nuts.services Put GPT5 into agent mode then give it that URL and the token 'linkedinPROMO1' and once it loads the tools tell it to use curl in a terminal (it's faster) and then run the random tool. This is authenticated at the moment with that token, plus bearer tokens, but I've got the new auth system up and its working. I still have to do the integration with all the other services (the website, auth, AHP and the crawler and OCR engine), so will be a while before all that's done.

xmorse 1y ago

This is how tools are implemented in latest Gemini models like gemini-2.5-flash-preview-native-audio-dialog: the LLM has access to a code execution tool that can run code in python and all tools are available in a default_api class

sam0x17 1y ago

Yeah I quite agree with this take. I don't understand why editors aren't utilizing language servers more for making changes. Crazy to see agents running grep and sed and awk and stuff, all of that should be provided through a very efficient cursor-based interface by the editor itself. And for most languages, they shouldn't even be operating on strings, they should be operating on token streams and ASTs

spacebanana7 1y ago
It's so weird that codex/claude code will manually read through sometimes dozens of files in a project because they have no easy way to ask the editor to "Find Usages". Even though efficient use of CLI tools might make the token burn not too bad, the models will still need to spent extra effort thinking about references in comments, readmes, and method overloading.
- ctoth 1y ago
  Which is why I wrote a code extractor MCP which uses Tree-sitter -- surely something that directly connects MCP with LSP would be better but the one bridge layer I found for that seemed unmaintained. I don't love my implementation which is why I'm not linking to it.
  - tough 1y ago
    both opencode and charm's crush support LSP's and MCP's as configs
- doikor 1y ago
  We have that in Scala with the MCP tools metals provides but convincing Claude to actually use the tools has been really painful. https://scalameta.org/metals/blog/2025/05/13/strontium/#mcp-support https://scalameta.org/metals/blog/2025/05/13/strontium/#mcp-...
- fzzzy 1y ago
  Really? Github Copilot Agent can search. Interesting.

BLanen 1y ago

What this is saying is again, that MCP is not a protocol. Which is the point of MCP, making it essentially worthless because it doesn't define actual behavioral rules, it can only describe existing rules informally. This is because defining a formal system, that can do everything MCP promises to enable, is a logical impossibility.

larve 1y ago

codeact is a really interesting area to explore. I expanded upon the JS platform I started sketching out in https://www.youtube.com/watch?v=J3oJqan2Gv8 https://www.youtube.com/watch?v=J3oJqan2Gv8 . LLMs know a million APIs out of the box and have no trouble picking more up through context, yet struggle once you give them a few tools. In fact just enabling a single tool definition "degrades" the vibes of the model. Give them an eval() with a couple of useful libraries (say, treesitter), and they are able not only to use it well, but to write their own "tools" (functions) and save massively on tokens. They also allow you to build "ephemeral" apps, because who wants to wait for tokens to stream and a LLM to interpret the result when you could do most tasks with a normal UI, only jumping into the LLM when fuzziness is required. Most of my work on this is sadly private right now, but here's a few repos github.com/go-go-golems/jesus https://github.com/go-go-golems/go-go-goja https://github.com/go-go-golems/go-go-goja that are the foundation.

turnsout 1y ago

> One surprisingly useful way of running an MCP server is to make it an MCP server with a single tool (the ubertool) which is just a Python interpreter that runs eval() with retained state. Wow, you better be sure you have that Python environment locked down.

starkparker 1y ago
yeah, check out the article's "Security is a Sham" heading that explicitly covers why the author doesn't really give a shit
- turnsout 1y ago
  Yeah, I saw that, it's still just wild. I guess "YOLO" is one response to the difficulties of securing endpoints.

throwmeaway222 1y ago

problem with MCP right now is that LLMs don't natively know what it is an LLM natively knows bash and how to run things MCP is forcing a weird set of non-normal rules that most of the writing of the web doesn't support. Most of the web writes a lot about bash and getting things done. Maybe in a few years LLMs will "natively" understand them, but I see MCP more as a buzzword right now.

dragonwriter 1y ago
> problem with MCP right now is that LLMs don't natively know what it is Most models that it is used with natively know what tools are (they are trained with particular prompt formats for the use of arbitrary tools), and the model never sees MCP at all, it just sees tool definitions, or tool responses, in the format it expects in prompts. MCPs are a way to communicate information about tools to the toolchain running the LLM, when the LLM sees information that came via MCP it is indistinguishable from tools that might be built into the toolchain or provided by another mechanism.
- throwmeaway222 1y ago
  No that's not what I'm saying. If you tell an LLM that you need a report on a specific member of congress and provide a prompt saying you can use bash tools like grep/curl/ping/git/etc... just return bash then a formatted code block Or you can use fetch_record followed by a formatted code block of the name of a google search you want to perform. The LLM will likely use bash and curl because it NATIVELY knows what it is and is capable of, while this other tool you have to feed it all these parameters that it is not used to. I'm not saying go ahead and throw that in chatgpt, I'm talking from experience at our company using MCP vs bashable stuff, it keeps ignoring the other tools.
  - dragonwriter 1y ago
    It's possible that its not about "native knowledge" but about how the descriptions (which get mapped into the prompt) for each of the tools are setup (or even their order; LLM behavior can be very sensitive to not-obviously-important prompt differences.) I'd be cautious inferring generalizations about behavior and then explanations of those generalizations from observation of a particular LLM used via a particular toolchain. That said, that it does that in that environment is still an interesting observation.

PhilKunz 1y ago

How come noone mentioned serena MCP here until now :D

ryukafalz 1y ago

As ever, I think the answer to "how do we sandbox arbitrary code while still letting it do useful things?", whether human-written or machine-written, is with object capabilities. Run the generated code in a sandbox, but pass in capabilities to useful resources, whether that be remote servers, local directories, or whatever else. Then you know the bounds of what trouble it can get up to from the start.

pploug 1y ago

While I generally agree with the author on code over tools, the article could have benefitted from some concrete ways that this could have potentially been done somewhat securely by sandboxing, enforcing zero trust, network segmentation, and all the other known controls we've developed over the last decade. I love the optimism of this space, but fear that the "security is a sham" attitude will bite us all in the ass down the line.