Posted by Stwerner 2 days ago
Today there's no way I can talk an average person into getting MCP working without them having to modify some config files hidden away somewhere.
I would bet big money that as soon as Claude and ChatGPT add 1 click "app store" experiences everyone will be using them in a week.
It is not easy to "just" use an API as a human, plus a lot of APIs force you to deal with tokens and storing+executing code. In some cases it's easier for the LLM to simply fetch or curl basic APIs directly than waste context tokens on the overhead of an MCP tool call (e.g. all these weather tool examples), but with MCP consistency is much better, so depending on the use case MCP vs API both have advantages.
Since my comment is already pretty long: LLM+RSS+Fetch is a killer combination for me, and it's almost all off the shelf these days. Once I add an RSS merge tool I think it will be an excellent way to consume content.
Or how about ‘oh it looks like your client is using SOAP 1.2 but the server is 1.1 and they are incompatible’. That was seriously a thing. Good luck talking to many different servers with different versions.
SOAP wasn’t just bad. It was essentially only useable between same languages and versions. Which is an interesting issue for a layer whose entire purpose was interoperability.
Come to think of it - I don't know what the modern equivalent would be. AppleScript?
"IBM also once engaged in a technology transfer with Commodore, licensing Amiga technology for OS/2 2.0 and above, in exchange for the REXX scripting language. This means that OS/2 may have some code that was not written by IBM, which can therefore prevent the OS from being re-announced as open-sourced in the future. On the other hand, IBM donated Object REXX for Windows and OS/2 to the Open Object REXX project maintained by the REXX Language Association on SourceForge."
https://en.wikipedia.org/wiki/Rexx
https://en.wikipedia.org/wiki/OS/2#Petitions_for_open_source
It basically powers all inter communication in Windows.
Apps can expose endpoints that can be listed, and external processes can call these endpoints.
And then Active Scripting was supposed to be how you'd script those endpoints...
Now I am excited by MCP and would be all in except security.
Security is a huge issue.
Forget AI and imagine a system where you call APIs and you get both data and JS. And that JS executes at global scope with full access to other APIs. And so do all the other MCP servers. Furthermore the MCP server may go to arbitrary Web pages and download JS. And that JS e.g. from a strangers Github issue or Web search gets executes with full API privileges.
<cute animal interject> This isn't something MCP can fix. It is built into the dice rolling nature of LLMs. Turning predictions into privileged executions. And those dice can be loaded by any MCP server.
Or imagine surfing the Web using a 2001 browser with no protections against cross domain scripting. Then having a page where you choose what init scripts to run and then it cascades from there. You are logged into your bank at the time!This is what worries me. It's not USBC. It's sort of USBC but where you are ordering all your peripherals from Amazon, Ali express and Temu and the house is made of tinder.
I'm too young to be posting old_man_yells_at_cloud.jpg comments...
Maybe it's just that agentic LLMs have created a lot of interest in being interoperable, whereas efforts like Open API just didn't have any carrot to warrant the stick other than "wouldn't it be nice".
I remember when I first interacted with Marketo and I was wondering why people even bother trying to use this tool just to learn that Marketo has the best integration with Salesforce and thus, it’s almost a certainty that as you scale you’ll get to use it.
Salesforce in particular, relies a lot on the vendor ecosystem built on a platform that is so painful to inter operate with.
I’m very curious to see what effect this will have to them.