It was obvious hyperbole. I can believe that there are many companies where the boss heard about MCP and put it on a roadmap before anthropic decided that it wasn’t a good idea… and now the team is implementing this in the name of “we need to do some AI”

GraphQL also allows the LLM to DOS your service

Can you not just install/ restrict the available CLIs in the same way you do with MCPs?

Or what else am I missing about why MCP is more secure than a CLI?

MCP allows you to easily separate API requests from their access tokens, so that the LLM only has access to the requests part. Giving an LLM CLI access removes all boundaries, anything goes.

EDIT: to add an example: I have a personal claw agent that I only use CLI, I don't care. But I'm also building an agent inside a company product, and there we use MCP all the way.

You can easily do this with simple Unix `chmod x-rw` on a wrapper that makes HTTP requests, adding the access token as it does.

The point is that you still need to expose a shell or a wrapper around exec to launch those commands. That is t appropriate when I want to lock the model down to working entirely from a sandboxed environment and expose some basic tools which are not “entire posix user space”.

MCP servers are not dead, they’re just overused in contexts they don’t really make sense in.

Another examole which is trivial with MCP but hard with cli binaries: blocking certain commands, such as write operations from the agent. With MCP your client can easily have a blocklist for commands, but with cli you would need to code custom logic for each cli separately.

Just use scopes in the API key the agent uses? If you’re exposing something publicly that should be a requirement anyways.

That’s how I use gh, aws, etc. No need to modify any of the code in the cli, they’re just wrappers.

I want the harness to use read freely but require confirmation for write.

Server implementers have an information advantage than the client coders wiring clis together to do a job

Access control is the operating system's job, and modern OSes already provide plenty of great tools for doing that.

Just use the existing sandboxing infrastructure like bubblewrap, seccomp, etc. I have way more faith in that than in something than some regex-based blocklist.

How do you ensure the cli can use the auth without knowing how to read it ? It’s potentially a bearer Token

That sounds intuitively right but breaks down when you ask “inefficient at what?”. Are you efficient with CPU cycles or efficient with human working memory?

Edit: I lost the context that this is about building devtools where you can’t just throw more hardware at the problem. But perhaps my answer still explains the reality: anthropic builds Claude with Claude so Claude needs to be easy to build with Claude.

Easier to read for humans is easy to read for LLMs. A more expressive language will bring about fewer misunderstandings when you apply stochastic tools like LLMs.

Just be sure you don’t choose something heavier/slower that is not more expressive.

The post talks about LLM+human contributions being recognized in some different category from human-only. But is it possible to spot the difference between the two?

This is a refreshing take but I’d really have liked an example for contrast.

How do you have the “modify LLM state from within” working? I can have it modify my config but I don’t know how to get it to eval and improve arbitrary elisp.

gptel has the built-in tool to eval elisp, prompt the LLM to make changes in the active Emacs session and watch it do it.

Absolutely baffled too. I was expecting that they preferred the vim philosophy of small tools that do one thing well, but no. So you like modal editing, well you’ve got it right there in emacs. Why that of all the potential gripes you might have with emacs?

Just a guess, but I think the answer may be in another post he links to. He wants to move to a tool that will work out of the box. He's deliberately moving away from an editing tool that is super-customized. That seems to be consistent with other changes he is making in his work habits. Personally, I can relate to this. I don't edit very often these days and each time I do it seems like I have to do a bunch of dot file and package maintenance.

I’d like a concrete example on how you’re actually controlling emacs with LLMs. Is ECA the part that does that?

gptel has the built-in elisp eval tool. ECA doesn't have it built-in, I use my custom MCP (I posted the link in the comment above).