Hacker News Reader

Comment by mehdibl | Hacker News Reader

MCP have a BAD UI?

MCP is not a UI. Seem someone here quite confused about what is MCP.

MCP have no security? Someone don't know that stdio is secure and over SSE/HTTP there was already specs: https://modelcontextprotocol.io/specification/2025-03-26/bas....

MCP can run malicious code? Apply to any app you download. How this is the MCP issue? Happen in vscode extensions. NPM libs. But blame MCP.

MCP transmits unstructured text by design?

This is totally funny. It's the tool that decide what to respond. Annd the dialogue is quite

I start feeling this post is a troll.

I stopped reading and even worth continuing over prompt injection and so on.

View on HN

MCP is absolutely a UI. It's just that the "user" is an LLM agent. Properly defining that interface is the main crucial piece of developing any tool.

OK the HTTP is a UI. Seriously, these comment are trolling.

Please don't resort to accusing others of trolling, or of telling them they didn't read something (https://news.ycombinator.com/item?id=43677540). These are swipes, which the HN guidelines ask you to edit out of your posts here: https://news.ycombinator.com/newsguidelines.html.

If people are posting bad information or bad arguments, it's enough to respond with good information and good arguments. It's in your interests to do this too, because if you make them without swipes, your arguments will be more credible.

We have to draw some line on good faith vs bad faith arguments though. Not understanding the difference between a UI and API is a stretch and purposefully conflating them just to win a semantic argument is not productive.

The problem is that internet readers are far, far too prone to classify others as being in bad faith, so in practice, "drawing the line" usually amounts to a provocation. This bias is so strong that I don't think people can be persuaded to draw that line more accurately.

Moreover, the concept of good faith / bad faith refers to intent, and we can't know for sure what someone's intent was. So the whole idea of assessing someone else's good-faith level is doomed from the start.

Fortunately, there is a strategy that does work pretty well: assume good faith, and reply to bad information with correct information and bad arguments with better arguments. If the conversation stops being productive, then stop replying. Let the other person have the last word, if need be—it's no big deal, and in cases where they're particularly wrong, that last word is usually self-refuting.

> MCP can run malicious code? Apply to any app you download. How this is the MCP issue? Happen in vscode extensions. NPM libs. But blame MCP.

Nobody is saying MCP is the only way to run malicious code, just that like VSCode extensions and NPM install scripts it has that problem.

> Someone don't know that stdio is secure

I'm sure someone in the comments will say that inter-process communication requires auth (－‸ლ.

It absolutely does

Reply on news.ycombinator.com