Hacker Newsnew | past | comments | ask | show | jobs | submit | DieErde's commentslogin

Why is the concept of "MCP" needed at all? Wouldn't a single tool - web access - be enough? Then you can prompt:

    Tell me the hottest day in Paris in the
    coming 7 days. You can find useful tools
    at www.weatherforadventurers.com/tools
And then the tools url can simply return a list of urls in plain text like

    /tool/forecast?city=berlin&day=2026-03-09 (Returns highest temp and rain probability for the given day in the given city)
Which return the data in plain text.

What additional benefits does MCP bring to the table?


A few things: in this case, you have to provide the tool list in your prompt for the AI to know it exists. But you probably want the AI agent to be able to act and choose tools without you micromanaging and reminding it in every prompt, so then you'd need a tool list... and then you're back to providing the tool list automatically ala MCP again.

MCP can provide validation & verification of the request before making the API call. Giving the model a /tool/forecast URL doesn't prevent the model from deciding to instead explore what other tools might be available on the remote server instead, like deciding to try running /tool/imagegenerator or /tool/globalthermonuclearwar. MCP can gatekeep what the AI does, check that parameters are valid, etc.

Also, MCP can be used to do local computation, work with local files etc, things that web access wouldn't give you. CLI will work for some of those use cases too, but there is a maximum command line length limit, so you might struggle to write more than 8kB to a file when using the command line, for example. It can be easier to get MCP to work with binary files as well.

I tend to think of local MCP servers like DLLs, except the function calls are over stdio and use tons of wasteful JSON instead of being a direct C-function call. But thinking of where you might use a DLL and where you might call out to a CLI can be a useful way of thinking about the difference.


The point is authorization. With full web access, your agent can reach anything and leak anything.

You could restrict where it can go with domain allowlists but that has insufficient granularity. The same URL can serve a legitimate request or exfiltrate data depending on what's in the headers or payload: see https://embracethered.com/blog/posts/2025/claude-abusing-net...

So you need to restrict not only where the agent can reach, but what operations it can perform, with the host controlling credentials and parameters. That brings us to an MCP-like solution.


But this is no different to using an API key with access controls and curl and you get the same thing.

MCP is just as worse version of the above allowing lots of data exfiltration and manipulation by the LLM.


But MCP uses Oauth. That is not a "worse version" of API keys. It is better.

The classic "API key" flow requires you to go to the resource site, generate a key, copy it, then paste it where you want it to go.

Oauth automates this. It's like "give me an API key" on demand.


An MCP server lets you avoid giving the agent your API key so it can't leak it. At least in theory.

You could do the same with a CLI tool but it's more of a hassle to set up.


For me (actually trying to get shit done using this stuff) it's validation.

Being able to have a verifiable input/output structure is key. I suppose you can do that with a regular http api call (json) but where do you document the openapi/schema stuff? Oh yeah...something like mcp.

I agree that mcp isn't as refined as it should be, but when used properly it's better than having it burn thru tokens by scraping around web content.


Validation is underrated. The same need for structure shows up on the prompt side too.

When your system prompt is one big paragraph, you can't easily tell which section causes unexpected output. Typed blocks (role, constraints, output format) give you the same verifiable surface that MCP gives you on the tool side. You can isolate and fix one block without touching the rest.

I built flompt (https://flompt.dev) for exactly this, a canvas that decomposes prompts into 12 typed blocks and compiles to Claude-optimized XML. Same idea: structure first, then composition. Open-source: github.com/Nyrok/flompt

A star on github.com/Nyrok/flompt is the best way to support it. Solo project, every star helps.


One thing that I currently find useful on MCPs is granular access control.

Not all services provide good token definition or access control, and often have API Key + CLI combo which can be quite dangerous in some cases.

With an MCP even these bad interfaces can be fixed up on my side.


The prophecy of the hypermedia web

I feel like I haven’t read anything about this in combination with mcp and like I am taking crazy pills: does no one remember hateoas?

Proxying / gatekeeping

    It’s the relationships, stupid
But is it relationships with just anybody? Or relationships with emotionally healthy, intelligent, adventurous people who share my interests?

Maybe I have to climb Maslow’s pyramid to be compatible with those?


I believe it’s a lifelong journey towards healthy relationships with anyone. We don’t start there, and we might never get to the finish line. That includes non-violent boundary setting; not friends with everyone, but relationship. Soft boundaries, where you neither cling on to something that was but no longer is without the need to blame self or other, nor you avoid contact with something new and unknown. To let go of the fight against personal limits and circumstances one cannot change. Not at once, and not without testing, but layer by layer.

Everybody is adventurous; each in their own way. You can invite people to your personal adventure, and be part of theirs, for as long or short as it serves the both of you.


    Everybody is adventurous; each in their own way.
This is actually a common statement people make with whom I feel bored. I call it the "evasive defense".

Me: "Let's fly to Paris tomorrow!"

People: "Nah, I'm fine just doing what I did the last 3650 days. I wonder how I deal with this issue I have with my boss at work. That is enough adventure for me."

Me: "Trash the job! Let's start a startup!"

People: "Nah, that is not for me. The benefit-to-work ratio at my current job is just too good."


Have you actually shown genuine interest in their adventures, or is it you who defines what is adventurous and what is not, and not see that they defend against your interests, and by that protect their own? Why do you feel the need to make decisions for them? Is it you that is unhappy about their choices, or is it them? (How did your parents react to your wishes and desires? Was your autonomy celebrated, or dismissed? Do you find yourself subordinating your own interests below those of others, and say yes to things you would rather say no to?)

    “NO is always a YES to something else.” - Marshall Rosenberg
I've been to Paris often enough, no thank you. And I prefer to go with people that respect and celebrate my autonomy. I wish you a good trip though!

I'm not making decisions for anybody. You can stay at home and watch your garden grow. Fine with me. I described what type of people I like. And that those are rather the pyramid climbers.

Things I consider most adventurous: Facing past trauma and healing from it, including coming to terms and re-arranging family relationships and other social relationships without causing harm. Taking responsibility in the world, both for past actions and future ones. Raising children with unconditional love. Settling conflicts in ways that result in a good outcome for everyone involved. Arranging life in a way to make these activities possible.

None of those adventures involve pyramids or startups, but a lot of courage, energy, and dragons.

I wonder how much you know about what people consider their own adventures, and how many they have had to face. Like divorce. Or sudden loss of job. Real world stuff.


Some empathy for other people would go a long way.

I agree that more empathy would enrich mundane interactions.

But I also think it is worthwhile to look for other adventurous people with whom I can share my own interests.


Adventure can take many forms, you just have to look outside yourself to see. For example, I’ve flown to Paris many times, that’s no longer an adventure for me (though I do love visiting the Louvre any time I’m in Paris). Finding adventure and interest in everyday life whether it’s traveling to a new place or visiting my local coffee shop is the real adventure for me. So many people are amazing, but you have to be curious. I wish you luck on finding whatever it is you’re seeking.

K but the person in his example said he was fine doing the same thing he had been doing for the bast decade, not that he didn't want to go to Paris cause hed already gone there. People enjoy their little ruts because they dont want to leave their comfort zone.

This is something I keep thinking about: the spectrum between sainthood (selflessly hang out with the poor/uninteresting/selfish/etc) vs selfish optimization (becoming more interesting/pretty/rich/generous in order to have access to nicer people)

From my own experience, and yours might differ, I typically don't find that pretty or rich (or any other such attributes) make for more interesting and nicer. Why is it either selfless saint or egocentrism? You can do both!

I imagine the person is talking about optimising along the lines you personally value for. Some people may value being with other interesting people (and being interesting themselves), wheras others prefer to be around smart people, or beautiful people, or rich people. Many see some of these desires as misguided or foolish or vain or whatever (often when it conflicts with their own values), but it is true that at least some people seem to want these.

My point being: If you value hanging out with people you don't like, it's still "selfish" (revolving around your own values).

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: