Thread

1. simonw · 1789935881 · focus · HN ↗

   This article entirely misses the value that MCP brings today.

   Sure, there's almost no reason to use MCPs if you are running a full-blown terminal agent (Claude Code, Codex, Meta Muse, OpenClaw etc) with unfettered internet access - just let it call APIs directly.

   If you want to operate something that's less YOLO than that, you'll find yourself wanting:

   1. Control over exactly which external services it can access

   2. A way to handle authentication that doesn't allow the agent to directly access API keys

   3. A sensible UI to allow users to connect and authenticate further services

   4. Strong audit logging for what's going on

   MCP makes all of that so much easier to provide.

   Thinking MCP is obsolete because full coding agents don't need it misses out on all of the other things we might want to build.

   1. pragma_x · 1789998224 · focus · HN ↗

      As someone who has never used MCP, or allowed an AI to directly talk to APIs, putting something between a model and a service just seems like common sense. If nothing else, it presents an opportunity to tightly control what the AI is allowed to do with external services, especially if the MCP code is outside of the AI's context. I would go as far as to say it's a necessary security measure.

      1. jimbokun · 1790001483 · focus · HN ↗

         The service itself needs to control what the agent can access.

         Relying on an intermediary to provide access controls, and that agents will never access the service directly, seems dangerous and naive.

         1. jayd16 · 1790003972 · focus · HN ↗

            What? Why? More is more but you're arguing a security proxy is a dangerous and naive pattern?

            1. jimbokun · 1790048844 · focus · HN ↗

               What’s the advantage of MCP over a regular old security proxy?

               1. Sattyamjjain · 1790484750 · focus · HN ↗

                  [dead]

         2. anon84873628 · 1790004648 · focus · HN ↗

            And it's easy for the service to do that by hosting a remote MCP server.
         3. Tractor8626 · 1790013877 · focus · HN ↗

            Agent doesn't have api key to access service directly

Unofficial Hacker News client; not affiliated with Y Combinator.