Everything will go to the simplest and most convenient, often both, despite the resistance of the complexity lovers.
Sorry MCP, you are not as simple as CLI/skill/combination, and no, you are not more secure just because you are buried under 3 level of spaghetti. There are no reason for you to exist, just like Copilot. I don't just wish, but know you'll go into obscurity like IE6.
MCP is just wrapper on top of API layer that RCP to a worker/daemon. That API layer itself can be the CLI. You get no more context usage, and no extra security impact, because fundamentally the model are the same, just without the fluff.
You are probably thinking of CLI as in "oh I must pass everything and it is stateless", only some need to be like that.
however it can't get infected because there is no internet access.
the worst you can do is put your secrets in the web search box
MCP is just a wrapper on top, there are no inherent differences other than complexity on top.
How do you think MCP work under the hood?
i would still have to make a proxy for the cli tool because i don't want the agent having secrets in its container