10 ms·

I still dont fully understand the point of MCP servers. What do they provide that a skill doesnt? Maybe I've just used too many poorly written ones. Is there s

by zlurker 6mo ago

I still dont fully understand the point of MCP servers. What do they provide that a skill doesnt? Maybe I've just used too many poorly written ones. Is there some sort of tool that can be expressed as an MCP and but not as an API or CLI command? Obviously we shouldnt map existing apis to MCP tools, but why would I used an MCP over just writing a new "agentic ready" api route?

paulddraper 6mo ago
Authentication for one.
simonw 6mo ago
I know of two benefits to MCP over Skills: - If your agent doesn't have a full Bash-style code execution environment it can't run skills. MCP is a solid option for wiring in tools there. - MCP can help solve authentication, keeping credentials for things in a place where the agent can't steal those credentials if it gets compromised. MCPs can also better handle access control and audit logging in a single place.
- staticassertion 6mo ago
  Can you explain the auth part? I feel like auth for an agent is largely a matter of either verifying its context or issuing it a JWT that's scoped to its rights, which I assume is quite similar to how any tools would work. But I'm very unfamiliar with MCP.
  - monkpit 6mo ago
    I think they’re saying you could start up the mcp and pass it creds/auth for some downstream service, and then the LLM uses the tool and has auth but doesn’t know the creds.
    - simonw 6mo ago
      Right. If you're running a CLI tool that is authenticated there's effectively no way to prevent the coding agent from accessing those credentials itself - they're visible to the process, which means they're visible to the agent. With MCP you can at least set things up such that the agent can't access the raw credentials directly.
      - zbentley 6mo ago
        This is right. It’s not about scoping auth, it’s about preventing secret misuse/exfil. (Moved from wrong sub)
      - steve-atx-7600 6mo ago
        Also, you can set permissions to allow and disallow specific mcp server tool calls. With a skill you’d have to do something in the shell environment to block unwanted behaviors with auth or other means in a way that isn’t declarative.
      - dcherman 6mo ago
        How so? Let's use a common CLI tool as an example - kubectl. Config is generally stored in ~/.kube in a variety of config files. Running `kubectl config view` already redacts the auth information from the config. LLMs could invoke `kubectl` commands without having knowledge of how it's authenticated.
        simonw 6mo ago
        If the agent has permission to run kubectl config view what's to stop it from reading those config files directly?
        dcherman 6mo ago
        The same permissions model that works for other tools. In Claude Code terms, allow Bash(kubectl:*). Deny Read(**/.kube/**). That allows kubectl access without allowing the tool to read ~/.kube directly. Your argument is the same for an MCP server - auth is stored somewhere on disk, what's to stop it from reading that file? The answer is the same as above.
    - deleted 6mo ago
      [deleted]
    - JambalayaJimbo 6mo ago
      The MCP implementation is itself an agent right? Is that not just pushing the problem somewhere else? Also, I run programs on my machine with a different privilege level than myself all the time. Why can’t an agent do that?
      - simonw 6mo ago
        I define the agent as the harness that runs the LLM in a loop calling tools. The MCI implementation is one of those tools. I wouldn't call an MCP implementation an agent.
      - conception 6mo ago
        No, mcp just is a server that returns prompts to the llm. The server can be/do whatever. You can have an echo mcp that list echoes back whatever you send it.
      - gavmor 6mo ago
        Typically, no; an MCP is a deterministic program with SSE protocols.
    - staticassertion 6mo ago
      Oh. Yeah, that's neat at least. I don't think it's a big deal but that's nice enough.
- simianwords 6mo ago
  I don't agree with either. Skills with an API exposed by the service solves both your problems. The LLM can look at the OpenAPI spec and construct queries - I often do this pretty easily.
  - simonw 6mo ago
    How can you disagree with my first point? You can't use skills if you don't have a Bash environment in which to run them. Do you disagree? Skills with an API exposed by the service usually means your coding agent can access the credentials for that service. This means that if you are hit by a prompt injection the attacker can steal those credentials.
    - simianwords 6mo ago
      Fair points, learned something new.
    - ntonozzi 6mo ago
      Something like Cloudflare's Code Mode fixes both of these! No privileged bash environment, no VM necessary, no exposing credentials to the LLM. As the article states, LLMs are fantastic at writing code, and not so good at issuing tool calls.
      - m11a 6mo ago
        Cloudflare's Code Mode is conceptually the same as Anthropic's Code Mode (https://www.anthropic.com/engineering/code-execution-with-mcp https://www.anthropic.com/engineering/code-execution-with-mc...), or the various open source implementations that predate and postdate those blog posts. tbh, that companies tried to make something proprietary of this concept is probably why its adoption has been weak and why we have "MCP vs CLI/Skills/etc" debates in the first place. In contrast, CLI tools only require a general a bash shell (potentially in a sandbox environment), which is very standardised.
  - mememememememo 6mo ago
    It creates a new problem. I need an isolated shell environment. I need to lock it down. I need containers. I need to ensure said containers are isolated and not running as root. I probably need Kubernetes to do this at scale. &tc Also even with above there is more opportunity for the bot to go off piste and run cat this and awk that. Meanwhile the "operator" i.e. the Grandpa who has an iPhone but never used a computer has no chance of getting the bot back on track as he tries to renew his car insurance. "Just going to try using sed to get the output of curl https://.." "I don't understand I just want to know the excess for not at fault incident when the other guy is uninsured". Everyone has gone claw-brained. But it really is ok to write code and save that code to disk and execute thay code later. You can use MCP or even just hard coded API call from your back end to the service you wanna use like it's 2022.
- tomjwxf 6mo ago
  [dead]
- throwuxiytayq 6mo ago
  - MCPs can be long-running processes that have state, e.g., they can maintain a persistent connection with a server or local software. - MCPs are trivial to write and maintain - at least in my experience and language of choice - and bash scripts are cursed. But I guess you can use a different scripting language. - Agents can pollute their context by reading the script. I want to expose a black box that just works.
Marazan 6mo ago
You can tightly constrain MCPs and shape the context that is shared back to the Agent. A skill is, at the end of the day, just a prompt.
- dionian 6mo ago
  true but we could also integrate a non-MCP app with a skill and put the controls there.
- zapnuk 6mo ago
  Thats just one of the interpretations of a skill. A skill can also act as an abstraction layer over many tools (implemented as an mcp server) to save context tokens. Skills offer a short description of their use and thus occupy only a few hundled tokens in the context compared to thousends of tokens if all tools would be in the context. When the LLM decides that the skill is usefull we can dynamically load the skills tools into the context (using a `load_skill` meta-tool).
dathanb82 6mo ago
Skills are part of the repo, and CLIs are installed locally. In both cases it's up to you to keep them updated. MCP servers can be exposed and consumed over HTTPS, which means the MCP server owner can keep them updated for you. Better sandboxing. Accessing an MCP server doesn't require you to give an agent permissions on your local machine. MCP servers can expose tools, resources, and prompts. If you're using a skill, you can "install" it from a remote source by exposing it on the MCP server as a "prompt". That helps solve the "keep it updated" problem for skills - it gets updated by interrogating the MCP server again. Or if your agentic workflow needs some data file to run, you can tell the agent to grab that from the MCP server as a resource. And since it's not a static file, the content can update dynamically -- you could read stocks or the latest state of a JIRA ticket or etc. It's like an AI-first, dynamic content filesystem.
- swingboy 6mo ago
  You can install skills globally so they are available in all projects.
alexwebb2 6mo ago
You could get pretty far with a set of agent-focused routes mounted under e.g. an /agents path in your API. There'd be a little extra friction compared to MCP – the agent would presumably have to find and download and read the OpenAPI/Swagger spec, and the auth story might be a little clunkier – but you could definitely do it, and I'm sure many people do. Beyond that, there are a few concrete things MCP provides that I'm a fan of: - first-class integration with LLM vendors/portals (Claude, ChatGPT, etc), where actual customers are frequently spending their time and attention - UX support via the MCP Apps protocol extension (this hasn't really entered the zeitgeist yet, but I'm quite bullish on it) - code mode (if using FastMCP) - lots of flexibility on tool listings – it's trivial to completely show/hide tools based on access controls, versus having an AI repeatedly stumble into an API endpoint that its credentials aren't valid for I could keep going, but the point is that while it's possible to use another tool for the job and get _something_ up and running, MCP (and FastMCP, as a great implementation) is purpose built for it, with a lot of little considerations to help out.
9dev 6mo ago
If you expand your scope a bit from just developer tooling, you’ll notice a lot of scenarios where an agent running somewhere as a service may need to invoke commands elsewhere, in other apps, or maybe provided by a customer in a bring-your-own-MCP setup. In these cases, the harness is not running locally, you don’t have a filesystem to write skills on demand to (or a fixed set of skills is baked into the container), so to get extensibility or updates to tooling, you want something that avoids redeployments. MCP fills that spot.
yoyohello13 6mo ago
I built an MCP server various people in our company can use to query our various databases. I can have a service account scoped only to the non-sensitive data, and users only need to have an MCP aware agent on their computer instead of dealing with setting up drivers, DB tools, etc.
IanCal 6mo ago
You could write an api, and then document it, and then add maybe useful prompts? Then you’d need a way of passing all that info on to a model, so something top level. It’d be useful to do things in the same way as others (so if everyone is adding Openapi/swagger you’d do the same if you didn’t have a reason not to). And then you’ve just reinvented something like MCP. It’s just a standardised format.
lagrange77 6mo ago
> Obviously we shouldnt map existing apis to MCP tools Why? Isn't obvious to me..
- alexwebb2 6mo ago
  Yeah, this deserves a quick explanation. When a human is coding against a traditional API, it might be a bit annoying if the API has four or five similar-sounding endpoints that each have a dozen parameters, but it's ultimately not a showstopper. You just spend a little extra time in the API docs, do some Googling to see what people are using for similar use cases, decide which one to use (or try a couple and see which actually gets you what you want), commit it, and your script lives happily ever after. When an AI is trying to make that decision at runtime, having a set of confusing tools can easily derail it. The MCP protocol doesn't have a step that allows it to say "wait, this MCP server is badly designed, let me do some Googling to figure out which tool people are using for similar use cases". So it'll just pick whichever ones seems most likely to be correct, and if it's wrong, then it's just wasted time and tokens and it needs to try the next option. Scaled up to thousands or millions of times a day, it's pretty significant. There's a lot of MCP servers out there that are just lazy mappings from OpenAPI/Swagger specs, and it often (not always, to be fair) results in a clunky, confusing mess of tools.
jcelerier 6mo ago
> Is there some sort of tool that can be expressed as an MCP and but not as an API or CLI command? ... most standard desktop software? How do you interact with Blender, Unity3D, Ableton Live, Photoshop, DaVinci Resolve, ... when they don't provide any API or programmatic CLI and don't want to open random network ports but will be absolutely fine with opening a tightly controlled local channel through a fd / pipe like MCP uses ?

by zlurker 6mo ago

paulddraper 6mo ago

Authentication for one.

simonw 6mo ago

I know of two benefits to MCP over Skills: - If your agent doesn't have a full Bash-style code execution environment it can't run skills. MCP is a solid option for wiring in tools there. - MCP can help solve authentication, keeping credentials for things in a place where the agent can't steal those credentials if it gets compromised. MCPs can also better handle access control and audit logging in a single place.

staticassertion 6mo ago
Can you explain the auth part? I feel like auth for an agent is largely a matter of either verifying its context or issuing it a JWT that's scoped to its rights, which I assume is quite similar to how any tools would work. But I'm very unfamiliar with MCP.
- monkpit 6mo ago
  I think they’re saying you could start up the mcp and pass it creds/auth for some downstream service, and then the LLM uses the tool and has auth but doesn’t know the creds.
  - simonw 6mo ago
    Right. If you're running a CLI tool that is authenticated there's effectively no way to prevent the coding agent from accessing those credentials itself - they're visible to the process, which means they're visible to the agent. With MCP you can at least set things up such that the agent can't access the raw credentials directly.
    - zbentley 6mo ago
      This is right. It’s not about scoping auth, it’s about preventing secret misuse/exfil. (Moved from wrong sub)
    - steve-atx-7600 6mo ago
      Also, you can set permissions to allow and disallow specific mcp server tool calls. With a skill you’d have to do something in the shell environment to block unwanted behaviors with auth or other means in a way that isn’t declarative.
    - dcherman 6mo ago
      How so? Let's use a common CLI tool as an example - kubectl. Config is generally stored in ~/.kube in a variety of config files. Running `kubectl config view` already redacts the auth information from the config. LLMs could invoke `kubectl` commands without having knowledge of how it's authenticated.
      - simonw 6mo ago
        If the agent has permission to run kubectl config view what's to stop it from reading those config files directly?
        dcherman 6mo ago
        The same permissions model that works for other tools. In Claude Code terms, allow Bash(kubectl:*). Deny Read(**/.kube/**). That allows kubectl access without allowing the tool to read ~/.kube directly. Your argument is the same for an MCP server - auth is stored somewhere on disk, what's to stop it from reading that file? The answer is the same as above.
  - deleted 6mo ago
    [deleted]
  - JambalayaJimbo 6mo ago
    The MCP implementation is itself an agent right? Is that not just pushing the problem somewhere else? Also, I run programs on my machine with a different privilege level than myself all the time. Why can’t an agent do that?
    - simonw 6mo ago
      I define the agent as the harness that runs the LLM in a loop calling tools. The MCI implementation is one of those tools. I wouldn't call an MCP implementation an agent.
    - conception 6mo ago
      No, mcp just is a server that returns prompts to the llm. The server can be/do whatever. You can have an echo mcp that list echoes back whatever you send it.
    - gavmor 6mo ago
      Typically, no; an MCP is a deterministic program with SSE protocols.
  - staticassertion 6mo ago
    Oh. Yeah, that's neat at least. I don't think it's a big deal but that's nice enough.
simianwords 6mo ago
I don't agree with either. Skills with an API exposed by the service solves both your problems. The LLM can look at the OpenAPI spec and construct queries - I often do this pretty easily.
- simonw 6mo ago
  How can you disagree with my first point? You can't use skills if you don't have a Bash environment in which to run them. Do you disagree? Skills with an API exposed by the service usually means your coding agent can access the credentials for that service. This means that if you are hit by a prompt injection the attacker can steal those credentials.
  - simianwords 6mo ago
    Fair points, learned something new.
  - ntonozzi 6mo ago
    Something like Cloudflare's Code Mode fixes both of these! No privileged bash environment, no VM necessary, no exposing credentials to the LLM. As the article states, LLMs are fantastic at writing code, and not so good at issuing tool calls.
    - m11a 6mo ago
      Cloudflare's Code Mode is conceptually the same as Anthropic's Code Mode (https://www.anthropic.com/engineering/code-execution-with-mcp https://www.anthropic.com/engineering/code-execution-with-mc...), or the various open source implementations that predate and postdate those blog posts. tbh, that companies tried to make something proprietary of this concept is probably why its adoption has been weak and why we have "MCP vs CLI/Skills/etc" debates in the first place. In contrast, CLI tools only require a general a bash shell (potentially in a sandbox environment), which is very standardised.
- mememememememo 6mo ago
  It creates a new problem. I need an isolated shell environment. I need to lock it down. I need containers. I need to ensure said containers are isolated and not running as root. I probably need Kubernetes to do this at scale. &tc Also even with above there is more opportunity for the bot to go off piste and run cat this and awk that. Meanwhile the "operator" i.e. the Grandpa who has an iPhone but never used a computer has no chance of getting the bot back on track as he tries to renew his car insurance. "Just going to try using sed to get the output of curl https://.." "I don't understand I just want to know the excess for not at fault incident when the other guy is uninsured". Everyone has gone claw-brained. But it really is ok to write code and save that code to disk and execute thay code later. You can use MCP or even just hard coded API call from your back end to the service you wanna use like it's 2022.
tomjwxf 6mo ago
[dead]
throwuxiytayq 6mo ago
- MCPs can be long-running processes that have state, e.g., they can maintain a persistent connection with a server or local software. - MCPs are trivial to write and maintain - at least in my experience and language of choice - and bash scripts are cursed. But I guess you can use a different scripting language. - Agents can pollute their context by reading the script. I want to expose a black box that just works.

Marazan 6mo ago

You can tightly constrain MCPs and shape the context that is shared back to the Agent. A skill is, at the end of the day, just a prompt.

dionian 6mo ago
true but we could also integrate a non-MCP app with a skill and put the controls there.
zapnuk 6mo ago
Thats just one of the interpretations of a skill. A skill can also act as an abstraction layer over many tools (implemented as an mcp server) to save context tokens. Skills offer a short description of their use and thus occupy only a few hundled tokens in the context compared to thousends of tokens if all tools would be in the context. When the LLM decides that the skill is usefull we can dynamically load the skills tools into the context (using a `load_skill` meta-tool).

dathanb82 6mo ago

Skills are part of the repo, and CLIs are installed locally. In both cases it's up to you to keep them updated. MCP servers can be exposed and consumed over HTTPS, which means the MCP server owner can keep them updated for you. Better sandboxing. Accessing an MCP server doesn't require you to give an agent permissions on your local machine. MCP servers can expose tools, resources, and prompts. If you're using a skill, you can "install" it from a remote source by exposing it on the MCP server as a "prompt". That helps solve the "keep it updated" problem for skills - it gets updated by interrogating the MCP server again. Or if your agentic workflow needs some data file to run, you can tell the agent to grab that from the MCP server as a resource. And since it's not a static file, the content can update dynamically -- you could read stocks or the latest state of a JIRA ticket or etc. It's like an AI-first, dynamic content filesystem.

swingboy 6mo ago
You can install skills globally so they are available in all projects.

alexwebb2 6mo ago

You could get pretty far with a set of agent-focused routes mounted under e.g. an /agents path in your API. There'd be a little extra friction compared to MCP – the agent would presumably have to find and download and read the OpenAPI/Swagger spec, and the auth story might be a little clunkier – but you could definitely do it, and I'm sure many people do. Beyond that, there are a few concrete things MCP provides that I'm a fan of: - first-class integration with LLM vendors/portals (Claude, ChatGPT, etc), where actual customers are frequently spending their time and attention - UX support via the MCP Apps protocol extension (this hasn't really entered the zeitgeist yet, but I'm quite bullish on it) - code mode (if using FastMCP) - lots of flexibility on tool listings – it's trivial to completely show/hide tools based on access controls, versus having an AI repeatedly stumble into an API endpoint that its credentials aren't valid for I could keep going, but the point is that while it's possible to use another tool for the job and get _something_ up and running, MCP (and FastMCP, as a great implementation) is purpose built for it, with a lot of little considerations to help out.

9dev 6mo ago

If you expand your scope a bit from just developer tooling, you’ll notice a lot of scenarios where an agent running somewhere as a service may need to invoke commands elsewhere, in other apps, or maybe provided by a customer in a bring-your-own-MCP setup. In these cases, the harness is not running locally, you don’t have a filesystem to write skills on demand to (or a fixed set of skills is baked into the container), so to get extensibility or updates to tooling, you want something that avoids redeployments. MCP fills that spot.

yoyohello13 6mo ago

I built an MCP server various people in our company can use to query our various databases. I can have a service account scoped only to the non-sensitive data, and users only need to have an MCP aware agent on their computer instead of dealing with setting up drivers, DB tools, etc.

IanCal 6mo ago

You could write an api, and then document it, and then add maybe useful prompts? Then you’d need a way of passing all that info on to a model, so something top level. It’d be useful to do things in the same way as others (so if everyone is adding Openapi/swagger you’d do the same if you didn’t have a reason not to). And then you’ve just reinvented something like MCP. It’s just a standardised format.

lagrange77 6mo ago

> Obviously we shouldnt map existing apis to MCP tools Why? Isn't obvious to me..

alexwebb2 6mo ago
Yeah, this deserves a quick explanation. When a human is coding against a traditional API, it might be a bit annoying if the API has four or five similar-sounding endpoints that each have a dozen parameters, but it's ultimately not a showstopper. You just spend a little extra time in the API docs, do some Googling to see what people are using for similar use cases, decide which one to use (or try a couple and see which actually gets you what you want), commit it, and your script lives happily ever after. When an AI is trying to make that decision at runtime, having a set of confusing tools can easily derail it. The MCP protocol doesn't have a step that allows it to say "wait, this MCP server is badly designed, let me do some Googling to figure out which tool people are using for similar use cases". So it'll just pick whichever ones seems most likely to be correct, and if it's wrong, then it's just wasted time and tokens and it needs to try the next option. Scaled up to thousands or millions of times a day, it's pretty significant. There's a lot of MCP servers out there that are just lazy mappings from OpenAPI/Swagger specs, and it often (not always, to be fair) results in a clunky, confusing mess of tools.

jcelerier 6mo ago

> Is there some sort of tool that can be expressed as an MCP and but not as an API or CLI command? ... most standard desktop software? How do you interact with Blender, Unity3D, Ableton Live, Photoshop, DaVinci Resolve, ... when they don't provide any API or programmatic CLI and don't want to open random network ports but will be absolutely fine with opening a tightly controlled local channel through a fd / pipe like MCP uses ?