Hacker Newsnew | past | comments | ask | show | jobs | submit | nostrebored's commentslogin

Skills can bundle scripts. Skills can express how to use curl. Skills can integrate with your fips keys if you want them to.

> Also, MCP is better for restricted environments because you know exactly what it can or cannot do.

The continuous exploits of MCP despite limited adoption really makes this seem wrong.


What about remote MCPs lend themselves to security? For instance, do you think that it is more secure than a traditional endpoint?

MCPs are basically just JSON-rpc. The benefit is that if you have applications that require an API key, you can build a server to control access (especially for enterprise). It's the same as REST apis, except by following a specific convention we can take advantage of generic tools (like the one I built) and means you don't need to rely on poor documentations to connect or train a model to use your very specific CLI.

But if you have customer facing APIs then all of these problems were already solved in an enterprise context. You can force an oauth flow from skills if you want.

I don’t think that CLIs are the path forward either, but you certainly don’t have to teach a model how to use them. We’ve made internal CLIs that adhere to no best practices and expose limited docs. Models since 4o have used them with no issue.

The amount of terminal bench data is just much higher and more predictable in rl environments. Getting a non thinking model to use an MCP server, even hosted products, is an exercise in frustration compared to exposing a cli.

A lot of our work is over voice, and I’ve found zero MCPs that I haven’t immediately wanted to wrap in a tool. I’ve actually had zero MCPs perform at all (most recently last week with a dwh MCP and opus 4.6, where even the easiest queries did not work at all).


LLMs don't care about mcp vs CLI. CLIs enable LLMs to fetch/mutate data and build scripts with the same program. I think of it like a Linux dev in a box. Sometimes you want to just call a tool, sometimes you want to write a small program that calls that tool instead.

Why are they not calling APIs directly with strictly defined inputs and outputs like every other internal application?

The story for MCP just makes no sense, especially in an enterprise.


MCP is an API with strictly defined inputs and outputs.

This is obviously not what it is. If I give you APIGW would you be able to implement an MCP server with full functionality without a large amount of middleware?

I’ve implemented an MCP tool calling client for my application, alongside OAuth for it. It was hard but no harder than anything else similar. I implemented a client for interference with the OpenAI API spec for general inference providers, and it was similarly as hard. MCP. SDKs help make it easy; MCP servers are dead simple. Clients are the hard part, IMO.

MCP is basically just an RPC API that uses HTTP and JSON, with some other features useful for AI agents today.


If I gave you that could you implement Graphql from scratch without a large amount of middleware? Or are we now saying graphql api:s are not api:s?

Sorry, could you rephrase that?

Does MCP support authentication, SSO?

Yes it’s literally just standard OAuth that’s defined in the MCP spec. I spent this week implementing an auth layer for my app’s MCP client gateway.

It supports OAuth, IIRC. But I suppose the internal chatbot itself would require auth, and pass that down to the tools it calls.

The chatbot app initiates an OAuth flow, user SSOs, chatbot app receives tokens to its callback URL, then tool calls can access whatever the user can access.

If you use the official MCP SDK, it has interfaces you implement for auth, so all you need to do is kick off the OAuth flow with a URL it figures out and hands you, storing the resulting tokens and producing them when requested. It also handles using refresh tokens, so there's just a bit of light friendly owl finishing on top.

Source: I just implemented this for our (F100) internal provider and model agnostic chat app. People can't seem to see past the coding agents they're running on their own machines when MCP comes up.


Neat!

MCP really only makes sense for chatbots that don’t want to have per session runtime environments. In that context, MCP makes perfect sense. It’s just an adapter between an LLM and an API. If you have access to an execution engine, then yes CLI + skills is superior.

Only is doing a lot of work here. There are tons of use cases aside from local coding assistants, e.g., non-code related domain specific agentic systems; these don’t even necessarily have to be chatbots.

OP's point is about per session sandboxes, not them necessarily being "chatbots". But if you don't burry the agent into a fresh sandbox for every session you have bigger problems to worry about than MCP vs CLI anyway

actually local MCP just spawns a subprocess and talks via stdin/stdout.. same as CLI tool. Extra layer is only for remote case.

This might help if interested - https://vectree.io/c/implementation-details-of-stdio-and-sse...


This is entirely framing.

To most people “I want to deport minorities” would imply nothing about citizenship status.

Someone with the opposite opinion would frame it as “open borders”, which is an extremist viewpoint globally and also not what people on the left in the US are advocating for.

Media coverage in the US is partisan. This is not an insightful viewpoint or nearly as incendiary as you’re making it out to be.


Iran has been funding and arming groups which threaten maritime security for a while now. They also have been obviously attempting a nuclear weapons program while saying if they achieve their aim that they will do crazy shit.

I guess the games you think are stupid depend immensely on your priors.


Are you referring to Ansar Allah? Do you know why they decided to shutdown Bab Al Mandab?

So we are going to ignore the JCPOA? Also, the rumor is that there is another player in the region who has undeclared nuclear weapons and refuses IAEA inspections. Should we bomb them next?


is that really reason to go to war though?

the US has been doing that in the gulf of mexico; should we be destorying the american civilization as a result?


> is that really reason to go to war though?

Funding armed groups to essentially make war on your behalf does seem like a valid reason for the person being targeted to go to war.

As a general rule, if you shoot someone they will shoot back if capable.


What other option is there?

I don't approve of war (and Trump didn't handle it well). However I also don't approve of what Iran has been doing.


There are two crazy nations I know that can nuke without morals. Hint: Not Iran

Nukes is irrelevant. If someone dies it doesn't matter at all if it was a nuke or a conventional weapon. Nukes can do a lot more damage in one go, but if you are killed by something else you are just as dead. Iran was clearly working on killing people by non-nuclear means as well.

Israel and the US are both nuclear armed and are doing crazy shit.

Because it isn’t honest, it is investor hype that these frontier labs need people to believe despite obviously hitting the sublinear part of the improvement curve.

“It’s so dangerous, we’ve reached AGI, we just have to release models that are obviously incapable of abstraction for your safety”


Could we not get the same with EAFT? Maybe that’s what it’s doing but definitely not the first to think “let’s lock in high probability solutions”

In nemotron the high perplexity solutions are selected for RL, in VLM training a few people are looking at the entropy distributions of the training set, etc


These are completely orthogonal. That’s cool if you want to appeal to an in group, but I think you’ll find that a huge portion of the country thinks that we should have rules around immigration. So do most other countries.

You should probably argue your actual position instead of “your guy bad my guy good”. This comment is more Reddit than HN.


I don’t think this has ever actually been a critique. It solves societal problems in a way that many people don’t like while introducing others.

No, it doesn't solve any. You know this because of all the lying and child rape and murder. That's not how people who genuinely want to solve problems and improve society act.

It's basically just a power grab by a tiny fraction (< 1%) of the population against everyone else (including the rubes). And it doesn't make the rich happy either because we are social animals. It's better to be poor in Finland than super rich in Somalia.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: