New MCP Roadmap
blog.modelcontextprotocol.io
blog.modelcontextprotocol.io
Good. Introducing a bespoke new protocol was one of the more bone-headed things MCP did on initial release.
This would be more complex to implement for a simple server, but it’s not exactly difficult.
gRPC spans layers, and it uses HTTP in a more intrusive way than even MCP does — it expects to own the entire URL space at the IP/port in question. Using gRPC in a nontrivial way for MCP would be fairly heavy-weight: you would probably need to set up reflection and figure out how to bind all the MCP calls to it unless you just use it as a tunnel.
In the flip side: I’m currently designing an AI-adjacent protocol, and it will be able to map to WebTransport, but I don’t plan to define non-WebTransport HTTP bindings unless a very compelling reason appears. The main implementations will not use HTTP at all :)
I don't think there is any guarantee that HTTP will always be involved. For example I might be calling a local LLM via CLI/script on a server with a stdio MCP connector that just runs other CLI commands, and never sends any HTTP traffic.
What are you, some sort of luddite?
"MCP authorization today is built around a person approving access in a browser. That works well for interactive clients, but more and more of the callers are agents running as cloud workloads with their own identity, acting on behalf of a user who isn’t present, or delegating narrower authority to sub-agents. We want MCP servers to have a standardized way to recognize and trust those agent identities, built on existing standards rather than pasted API keys and long-lived tokens.
The work here covers finalizing Demonstrating Proof of Possession (DPoP) and driving its adoption, and defining an opinionated path for agent identity and delegation through Workload Identity Federation, the ID-JAG grant behind Enterprise-Managed Authorization, and standard token exchange. We will also continue to grow our engagement with the OAuth standards bodies, including the IETF OAuth and WIMSE working groups, to help the underlying standards evolve with the building blocks that agent identity needs."
And the individual work attached to making that transition will be done by agents.
1. workloads use existing credentials support RFC 7523 and OIDC discovery, 'trust the trust (credentials) which has already been established'. basically extend current dominant NHI paradigm.
2. DPoP mandate a signed proof for each request. so tie credential to a client-held key and specific request detail or context. viable to do at scale with #1, or does it diverge (e.g. because most #1 methods as most are not designed for DPoP?
1. Client generates a private/public keypair and uses it to generate DPoP Proofs - JWTs containing the entire public key embedded as a JWK within
2. Client presents credentials (WIF, client creds, auth code, etc.) to the Authorization Server along with a DPoP Proof
3. Authorization Server validates DPoP Proof and adds a claim to the access token containing the thumbprint - the SHA-256 hash - of the public JWK.
4. Resource Servers will now see the thumbprint claim and now know the access token needs to be presented with a fresh DPoP proof.
5. Clients generate fresh DPoP proofs and send them along with the access token
There are lots of additional details around nonces, timestamps, per-request binding, etc. but DPoP can be rolled out to any HTTP system that speaks Bearer token already.
I really love the idea of fully enabled agents and being able to cut down on human in the loop moments.
Things like https://projects.dev/ for example.
A ton of security problems and others to solve but it's still where I want the future of all this to go.
Having to define what an agent can do when it identifies on my behalf is cumbersome, especially when you start to get specialised agents.
Pattern based would be too easy for AI to game, but there's got to be a service independent way to limit permissions based on role.
I am Jack's right ear - awesome you get to hear stuff.
I am jack's right hand - great you get to input stuff.
What most end users want -- for the machine to do what they want, as often as possible, while bothering them as little as possible
Windows' UAC journey is a microcosm of the space. The real long-term win is defining ground level permissions around common use cases, so that when composed they can alert as rarely as possible.
But that's an all-of-ecosystem change: the OS (providing usable boundaries), applications (updating to use minimal boundaries), and users (understanding what they'll need to approve/deny).
I wrote about this more on my employer's blog[0].
> The real long-term win is defining ground level permissions around common use cases, so that when composed they can alert as rarely as possible.
And this is an even larger effort to implement, especially as agent capabilities change over time (and they are changing rapidly).
"Oh no it's a long lived token that's bad"
Put it in a secret manager like 1pw cli and now start an agent...
Authn/authz is one of those things that can be really simple for pointed use cases but gets really complex when you need to support everything.
https://www.1password.dev/get-started/secure-ai-access#secur...
https://1password.com/blog/1password-trusted-access-layer-fo...
Still far from perfect tho.
The complexity in these protocols is mostly essential in nature (to the extent that you're not willing to totally reinvent the protocol, like AAuth).
If I need to integrate with a third party service, I'm now skipping their MCP entirely and just going straight for the CLI or API, which are usually more full-featured. An agent usually doesn't even need a dedicated Skill for this.
> Put it in a secret manager like 1pw cli and now start an agent...
And when the agent does something stupid, your long lived token is compromised. It also makes it hard to segregate access (e.g. all those "Cursor deleted by production DB and all its backups because it had an API key that could do that").
Nope, you should instead use something that give short-lived tokens, ideally ones scoped based on the desired intent / operation. Or even better, skip the "agent gets a token" part at all, and have all agent operations pass through a gateway/agent/proxy/whatever that handles that part. That way even if the agent gets comrpomised or does something dumb, it doesn't have even a short lived token to give away.
Plus why spawning processes all the time.
Instead of the CEO mandating that the API server has to be agent compatible (where who knows what that means), they can just say "our product has an MCP".
On a technical level, who knows what it actually is (is it actually the new stateless version, does it have all the endpoints, is the regular API more feature-rich, do I need those features for my workflow?, etc.). But at a surface-level, the intention is clearer, and lets other gears (like sales and marketing) keep spinning without getting bogged down in technical details.
Are others doing this?
It seemed obvious to me, but I don't hear others saying it.
On low code/no code tools, you get additional metadata for webhooks.
It only has five CRUDE endpoint: Create, Read, Update, Delete, and Execute using a GraphQL-like structure for tool calling of the operations within the endpoints. It's very efficient, and robust. there's all kinds of exemplar tools and components to make adapters for any MCP server. You don't even need to rewrite your own MCP server. Just create an adapter for it.
All open source at MCPAQL.com
We tag each endpoint by category in the OpenAPI spec and require the MCP to request actions by tag and optional query term. At most we return 10 endpoints at a time and the LLM can request more using pagination.
These tags also create your categories in API doc websites like swagger/mintlify so its a win win.
OpenAPI spec is the single source of truth.
for agents, they're essentially the same thing - remote endpoints, and instructions on how to call those endpoints. what MCP brings is centralized updating and distribution of the instructions, and a promise that the skill and the REST api won't be out of sync with each other.
the one thing that skill.md+REST doesn't solve is how you get that skill.md to somebody else's computer, and how you ship an update to somebody else's computer once they've got a copy of the skill. if that's a problem you need to solve, you can either start inventing skill.md distribution protocols, or you can just use MCP.
This isn't a "bottleneck" but rather a capability (or lack thereof). As you add more and more capabilities, especially ones relevant to enterprise situations like authentication, authorization, governance, etc. then MCP starts to pay off.
If you do not need those capabilities, then you do not need MCP. And then you shouldn't use it. But if you do need those capabilities then it might be worth using MCP rather than inventing your own way to do them.
that is basically what MCP is. except it answers all the questions that your version handwaves away - how often do you get a fresh copy, how do you describe the relevant tool calls, how are the tools organized, and how does auth work.
But for enterprise there may be teams, each developing their own way to do it. Then there will be many different ways that it is done throughout the enterprise, which is hard re: governance. Better/easier to adhere to an industry standard which can be audited, especially for enterprises where that is a legal requirement.
That isn't a reason you should use it, just an explanation about why someone has to use it.
MCP has not smoothed over legacy cruft, and it is generally bad at exactly what you’re describing (many unintentionally coupled APIs with unintentional side effects). These require near deterministic trajectories and you’d be better off creating a consumer with a series of well known good patterns with useful results.
If you take it a step further you may allow for a common language and keyspace of these well known results and employ dynamic solvers that are entirely agnostic. LLMs have made creating these much easier!
But there are also folks who put thought into omitting extraneous fields, combining multiple low-level calls into a single tool that covers a common end-to-end use case, and writing much better documentation. With the political air cover that it is in service of the AI boom. Essentially it gave everyone the opportunity to implement API vN+1.
I can see that.
I am developing my first custom agents. I am finding that if I offload some workflow to another agent (e.g. Claude Code), the simplest way to control what it can or cannot do is via an MCP server (which only lets it access tools that I develop/approve myself). I do need that control in the corporate environment.
Maybe there are easier ways to do it, just learning and exploring now.
It's already in use in several places (e.g., https://www.mintlify.com/docs/ai/skillmd#skills-discovery-en...) and is supported by `npx skills add`.
What is not hard to understand is that EVERY MCP UPDATE is almost certainly a breaking change. The versioning story is not as mature. The models using it are different.
It is an unuseful fiction that by storing a blob of instructions next to a remote endpoint that things have been made easier.
it's like saying "i don't want to give Claude access to my file system but i'm fine letting it run bash" ......
LLMs do GREAT utilizing well-defined tools to accomplish tasks. Look at Datadog's MCP, instead of figuring out a multitude of filter and navigation options your LLM can immediately navigate to what you want and extract the precise data you need. Tool instructions with defined I/O structures let LLMs fly.
But for a nightly cron job pulling down stats or something like that? Why the hell do you want to route through a protocol built for in-person consumption? This is such a pointless overreach for the protocol. What would have been better is blessing a standardized pattern for exporting any MCP tool definition into a well-structured API endpoint. Then everything related to API endpoints like doc generation, comes along for free.
Instead we get this kitchen sink protocol that is going headlong toward polyfill hell, since no two IDEs support the same protocol features like structured content, local state, elicitations, etc., even from the same provider - Claude Code/Desktop/web all handle MCP connections differently. It's a shitshow.
Almost every major MCP service uses the same baseline default features (plain context) rather than build around partially-supported features. Why add more and more specs on the pile when adoption is so far behind?
To the LLM, the a skill input is deterministic, inflexible, and outputs natural language.
A REST API (not the REST itself, but modern output being JSON primitives) outputs are deterministic, flexible, but doesn't output natural language.
An MCP as an input is deterministic, flexible, outputs natural language.
Then we ask the same question on whether the LLM gets back a response that is deterministic. Skills output are not deterministic, it requires LLM to generate tokens to take action. It may or may not take the specific actions instructed by the skill.
So, Skills + REST API = MCP only if you can deterministically call on the REST API.
* /skill may or may not call on the instructed action
* /tool (or @tool) will guarantee the action is taken
This is overgeneralizing and we need to talk about harness-specific features like hooks (which adds a deterministic action to skill usage).
* Your agent can easily be configured to always allow certain MCP tools. This is very hard to do for only certain REST endpoints. This is even more relevant in enterprise settings, where permission configs might be done centrally.
* If the provider wants to change how an endpoint works, it's a breaking change for a REST API. Not with MCP, as the "endpoints" (tools) are dynamic and tell the agent how to use them.
Just give your end-users flexible options. If they have Claude Code then build more around the API side if needed.
Senior programmers always advised me to only use things that have been around for at least three years. Now I finally understand why.
Yikes. I can understand the desire to mitigate churn, but following this advice would be career suicide. Trying new things is essential.
Maybe I'm old, but at least in web dev it doesn't feel that long ago that someone had to argue for, e.g., Vite over webpack, Svelte over React, etc..
In a world where everyone followed rigid advice to stick to 3yo+ tech, Vite wouldn't exist, let alone have people to argue for it. Nor would the web, for that matter.
I'm _not_ saying "chase the new-and-shiny for its own sake", and I don't recommend introducing immature or untested dependencies in production. But it's essential to learn how to gauge the quality of a mature solution -- and IME the only way to do that is to have something to compare it to (ideally, something newer and better). Develop an instinct for separating the signal from the (considerable) noise by trying things. Newer isn't always better, but the arc does trend towards improvement. Dev tooling is rife with examples, and a great place to start.
As for "You have had a lot managers push newer frameworks/technologies on you?" On the contrary -- I've had managers wedded to outdated cruft that threatened to drag the whole enterprise down. Resistance to change is sometimes fear masquerading as wisdom.
Finally, note this whole thread is in the context of an update to the MCP spec. In the world of AI, 3 years might as well be 3 centuries.
At the same time, it's often smart to avoid putting things into production that haven't matured or demonstrated staying power.
Or, to badly mangle Postel's law:
Be liberal in what you learn, and conservative in what you deploy
And I’m not OP, but I would assume the senior developers made a distinction between try and use.
I had to give maintenance to things people deployed to pad their resumes with "shiny new thing", and it was not fun.
If you intend to deploy and leave that as legacy for some poor shlemiel, sure.
If you intend to stay and actually keep things running, it's much better to use tried and tested stuff.
Ive been in this industry nearly 40 years and I have seen many many people push new tech and later fail to deliver and suffer the consequences.
Experiment where it doesnt matter, everywhere else boring and old is a virtue.
I clearly remember there was a time coffeescript looked really like the future of javascript.
All while it is just a fancy way make your OpenSchema PAI visible to AI.
Kind of late to the party. I've had to implement lazy loading of mcps in a couple of harnesses now but am moving to implement everything as code mode instead.
I was getting fed up with AWS mcp telling me it is eol.
I'm in the process of switching all my personal stuff to a self-hosted fork of cloudflare-os right now. It's taking a lot of rearchitecting how my stuff works to fit within the cloudflare "no local files" paradigm, but for now I've got a container gatekeeper they can drive and they can check repos out in it.
Every gain in LLMs is either through increases in compute efficiency, Architecture or Harnesses...
The rest seems like bells and whistles
[1] https://doc.akka.io/libraries/akka-core/current/typed/actors...
100% up to the harness. Most harnesses either fixed (or dymanically depending on size) nowadays add a "search_tool" tool to prevent spamming the context with all tools.
Nobody needs to have every functionality of HTTP offloaded to MCP at all, at this point.
I'll stick to the bare minimum that works.
Its insane to me how quickly people flocked to the idea of building a parallel web to maintain for non humans.
I shouldnt be surprised seeing how low priority human accessibility and ux has been on the web when compared to the needs of the all consuming parasite that is ad tech.