Agent engineering · know-how
🛠️ Solution·active·35 entries·36 sources·updated 2026-10-25
The Model Context Protocol (MCP) is a standard way to describe, discover, and call tools so any MCP-speaking agent can use any MCP server. It collapses the N×M problem of bespoke integrations into one interface: the agent equivalent of "speak HTTP" instead of writing a custom client per service.
MCP is production infrastructure now. Infrastructure and SaaS vendors ship official servers, clouds host the tool loop and front MCP servers with managed gateways, and the browser is becoming a tool surface through WebMCP. The payload has widened past tool calls to reference data, agent memory, task queues, and deterministic computation.
The protocol itself just changed shape. The 2026-07-28 spec made MCP stateless, added governed extensions, and hardened authorization. Remote servers can drop sticky sessions and scale like any stateless service, and clients and SDKs are adopting the new version.
Governance is where the work moved. Connector access is provisioned through identity providers rather than per-user consent, managed settings decide which servers exist at all, and gateways and server-side controls decide what a connection may write. Production security guidance treats this as layered defense, not one gateway setting.
The open question is what MCP is for. Statelessness makes it look like "just an API" to some developers. The durable value is the shared tool-description and discovery layer and keeping credentials out of the agent's context, which matters most where an agent cannot call APIs freely. Interop is also unfinished: a server can reach GA while major clients still cannot connect because of identity-provider gaps.
Tool-definition quality and catalog search, the main levers for making many MCP tools usable at once, are tracked on tool use.
A shared protocol buys interoperability and reuse, but every connector you expose is a new permission and a new attack surface. MCP standardizes access, which makes authorization and blast radius the hard part (see prompt injection).
It also adds a moving dependency: server quality, spec versions, and uptime become yours to manage, and a misbehaving or malicious server is reachable by every agent that speaks the protocol. The stateless spec simplifies scaling but pushes state, retries, and idempotency back onto your own layers.
Best when you have many tools and many agents. It is overkill for a single hardcoded integration, or for a fully trusted terminal agent that can call APIs directly.
MCP is the integration layer you adopt instead of writing API wrappers. It turns tool connectivity into a fleet you provision and govern (identity-provider auth, managed server lists, per-connector write controls) rather than scattered glue code.
The platform job shifts from building connectors to running a connector registry safely: tracking spec versions across clients and servers, checking which clients your identity provider can actually admit, and treating each server as a dependency with its own security review.
The 2026-07-28 spec made MCP stateless and clients are catching up, which sharpens the debate over whether its value is discovery and auth isolation or just another API.
AWS details how the current spec removes protocol-level sessions, sticky-session requirements, and session storage for remote MCP servers. Each request routes independently, so a server scales like any other stateless service.
Application state, retries, observability, and idempotency move to the layers that already handle them for other APIs. See scalability for the same "remove the coordinator" pattern.
Responding to a Hacker News thread titled "MCP was always a bad idea?", Simon Willison argues the critique misses MCP's value today. A full terminal agent (Claude Code, Codex, OpenClaw) with unfettered internet access has little reason to use MCP and can call APIs directly. For anything more constrained than that, MCP is what you end up needing.
The value question sharpens rather than resolves: MCP matters most where the agent's reach is deliberately limited.
LangChain's MCP support now lives in langchain.mcp, built on FastMCP for the 2026-07-28 spec. Elicitation, where a server pauses mid-call to ask the agent for more information, is handled as a LangGraph interrupt. Tool lists are cached instead of re-fetched per call.
A mid-tool-call question reuses the pause/resume primitive LangGraph already uses for human-in-the-loop, not a bespoke callback.
Also relevant to Agents reach the outside world through fragile, ad-hoc integrations
claude-agent-sdk-python v0.2.140 widens its dependency to mcp>=1.23.0, supporting mcp 2.x alongside 1.x. In-process SDK MCP servers now use mcp's own in-memory transport instead of hand-rolled JSON-RPC dispatch, so hand-built mcp.server.Server instances pass resources, prompts, and all result content types through verbatim.
The harness's dependency version and the protocol version its in-process servers speak are less tightly coupled.
Also relevant to Agents reach the outside world through fragile, ad-hoc integrations
The 2026-07-28 spec removes the initialize handshake and session header and adds required method and tool-name headers, so gateways can route agent traffic without parsing JSON. Some developers call this a rediscovery of REST; others say the shared standard was always the point.
The debate clarifies what MCP adds over a plain API call: the shared tool-description and discovery layer, not the stateful session the spec just dropped.
Also relevant to Agents reach the outside world through fragile, ad-hoc integrations
The MCP 2026-07-28 specification is the largest revision since launch: the protocol is stateless by default, gains a governed extensions system, and hardens authorization. Amazon Bedrock AgentCore Gateway already supports it; switching a gateway over is a single UpdateGateway call.
This rewrites how clients and servers interoperate rather than adding a connector. A managed gateway gives platform teams a reference for adoption without patching each client.
Also relevant to Agents reach the outside world through fragile, ad-hoc integrations
A Hacker News comment by Sean Lynch, quoted by Simon Willison, argues that what MCP offers over skills or a CLI is isolating the auth flow outside the agent's context window, and possibly outside the harness entirely. Its idealized form might be "just an auth gateway for the API".
Read this way, MCP's durable win is credential handling, not the tool-description format. The same question returns once the stateless spec makes MCP look more like a plain API.
Connector access is now provisioned through identity providers and managed settings, with gateways and server-side write controls deciding what a connection may do.
Kevlar is an open-source MCP firewall posted to Show HN, a single self-described project. A malicious MCP server can use tool descriptions to redirect the model, pull credentials, or add tools. Kevlar sets every description to "" on each tools/list response before the client sees it, so the LLM gets only the name and inputSchema.
It also rebuilds inputSchema from an allowlist, dropping prose fields such as title, examples, and $comment, and validating enum values, keys, $ref targets, and types against the MCP spec.
For builders: this trades away description-driven tool selection for a smaller injection surface. Names and schemas must then carry the meaning.
Also relevant to Untrusted input and tools can hijack an agent
Claude Code v2.1.259 adds a managedMcpServers managed setting: an organization provides HTTP/SSE MCP servers to every user with the same entry shape as .mcp.json. Entries that name a command to run are skipped.
Governance extends from "who may connect" to "which servers exist at all", set centrally rather than per developer, and limited to remote servers.
Cloudflare's WriteGuard (private beta) adds fine-grained security controls to MCP servers, governing agent access to tools that modify data or perform actions rather than only read.
Identity-provider auth answers who connects; this answers what the connection may then do, enforced on the server side.
Microsoft released a dedicated AI Gateway tier of Azure API Management in public preview. Its control plane is built around models, MCP servers, and tools rather than APIs, and it fronts Foundry, Bedrock, Vertex AI, and OpenAI behind one endpoint, with policy cards instead of XML.
Architects welcomed the consolidation but questioned where the governance boundary sits. MCP server governance now sits next to model governance in a managed product.
Also relevant to Agents reach the outside world through fragile, ad-hoc integrations
An InfoQ article by Nik Kale lays out defense in depth for MCP across four architectural layers: safe execution, management infrastructure, outbound trust, and semantic integrity. It argues enforcement has to sit at the earliest trustworthy control point, not only at the gateway.
Securing MCP is a layered architecture decision, not one gateway setting. See prompt injection and agent sandboxing for what it defends against.
Also relevant to Agents reach the outside world through fragile, ad-hoc integrations
Codex 0.144.0 lets MCP tools request authentication interactively without an experimental opt-in. The same release adds a writes app-approval mode that allows declared read-only actions and prompts for writes.
Auth isolated from the harness now ships in a second major client, outside Anthropic's tooling.
The MCP project promoted its Enterprise-Managed Authorization extension to stable. Organizations control access to MCP servers through their identity provider, replacing per-server consent prompts with a zero-touch flow: sign in once, then reach approved servers without further setup.
It turns what single vendors had shipped one-off into a spec any MCP client or server can implement.
Also relevant to Agents reach the outside world through fragile, ad-hoc integrations
Claude Code v2.1.186 adds claude mcp login and claude mcp logout to authenticate MCP servers without the interactive /mcp menu, with a --no-browser stdin flow for completing auth over SSH.
Server auth becomes scriptable and works on remote hosts, keeping the credential flow outside the agent's conversation.
Admins can provision MCP connectors for the whole organization through their identity provider, starting with Okta. Users get connector access on first login, with authorization configured centrally.
Connector access moves from a per-user setup step to a fleet policy.
WebMCP lets web pages expose functions and forms as tools; it moved from a Chrome origin trial to a one-click Cloudflare toggle and agent browsers that call it.
Cloudflare and Commerce.com enabled WebMCP across almost 100,000 storefront domains without theme edits. An edge-injected script bridges tool definitions from the platform's backend MCP server (/api/mcp) into the browser, so an agent calls search_products and add_to_cart instead of clicking through variant drop-downs and cookie banners.
Merchant control is a Configuration Rule on custom-hostname metadata (webmcp_opt_out), evaluated before the page is served. Opted-out stores get no injected script. If the MCP server is offline or the browser lacks WebMCP, the script exits and the storefront loads normally. Checkout stays with the human.
For builders: one set of tools can serve both server-side MCP and in-browser agents. WebMCP is still an experimental Chrome-flag preview.
Kitesurf, Cloudflare's Workers-based browser for agents, now supports WebMCP, so an agent can call tools a site exposes (Cloudflare Radar's navigate-to, set-location) instead of simulating clicks. It also reports 730,000+ Web Platform subtests passing, about 500,000 more than at its August launch.
Both sides of WebMCP, the page that exposes tools and the agent browser that calls them, now ship from one vendor.
Cloudflare previewed automatic WebMCP support: any site can enable a WebMCP interface from a single dashboard switch, with no code change. Browser-based agents then interact with the unmodified page through structured tools instead of scraping, while human traffic stays on the original site.
WebMCP moves from an origin trial a team opts into to a toggle a site operator flips.
Also relevant to Agents reach the outside world through fragile, ad-hoc integrations
Persona.js is an MIT-licensed vanilla-JS library for building agentic experiences on the web, with no framework dependency and full WebMCP support.
The open-source client side fills in alongside the Chrome trial, so a site can add WebMCP without a vendor SDK.
Google put WebMCP into origin trials in Chrome 149. Sites can expose tools, such as JavaScript functions and HTML forms, to in-browser agents.
Agents can act through declared tools instead of costly screen reading or unreliable DOM scraping. The actuation surface for MCP extends to the web page itself.
Also relevant to Agents reach the outside world through fragile, ad-hoc integrations
Infrastructure and SaaS vendors now ship official MCP servers and managed gateways, but GA does not yet mean every major client can connect.
Databricks made its Genie One MCP server generally available, aimed at the AI coworkers and coding agents spreading across organizations.
Another vendor puts a core product surface behind the protocol rather than a bespoke API for agents.
Microsoft made the Azure DevOps Remote MCP Server generally available: a hosted endpoint into work items, repos, and pipelines with nothing to install. Claude Desktop, Claude Code, ChatGPT, and Cursor cannot connect yet, because Entra lacks dynamic client registration and Client ID Metadata Documents.
"GA" and "works with every major MCP client" are still separate milestones, and the gap sits in the auth layer.
Also relevant to Agents reach the outside world through fragile, ad-hoc integrations
AWS built a secure MCP bridge so a Bedrock AgentCore agent running in the cloud can call MCP servers on a user's own laptop. Signed messages tunnel over the existing WebSocket connection through a browser extension and Chrome native messaging, with no inbound ports or VPN.
It reverses the usual direction (a cloud agent reaching local tools and files) using the same protocol, not a bespoke remote-access tool.
Also relevant to Agents reach the outside world through fragile, ad-hoc integrations
AWS shows Amazon Bedrock AgentCore delivering cross-system business intelligence through configuration rather than custom code: pre-built MCP server connectors, fine-grained access control, and persistent memory let users query several data sources in natural language while role-based boundaries are enforced automatically.
Access control rides with the connectors instead of being re-implemented per integration.
A Show HN project, Coding Tools MCP, packages coding primitives as an MCP server so any LLM agent can edit and run code.
The long tail of small task servers keeps growing. Capabilities that used to belong to a specific harness become portable across clients.
An AWS reference build wires Amazon Quick and Cisco Webex MCP servers into one assistant. From a single prompt it finds an upcoming Webex meeting, reviews prior summaries, transcripts, and Vidcast highlights, searches message threads for unresolved follow-ups, and writes a prep brief.
Vendor SaaS servers compose into a working workflow without custom integration code.
HashiCorp made its open-source Terraform MCP Server generally available. It lets agents work with Terraform Registry APIs, aimed at relieving infrastructure engineers of rote tasks.
An official infrastructure vendor now ships the server itself, so teams don't maintain their own wrapper around the registry.
Also relevant to Agents reach the outside world through fragile, ad-hoc integrations
MCP now carries reference data, agent memory, task queues, symbolic reasoning, and execution primitives, making it a general plug for anything an agent consumes.
GitHub Security Lab's fuzzing taskflow for C/C++ splits the work cleanly: "the LLM agent owns the decisions, and the MCP tools own the execution." MCP tools run AFL with growing time budgets, compile harnesses, and store crashes. The model reads coverage reports and decides whether to add seeds, edit a harness, enrich a dictionary, or skip a plateaued path.
Structure-aware mechanisms (format dictionaries, source-extracted dictionaries, dynamic enrichment, corpus splicing) give the agent enough signal to reason about input formats. MCP acts as a pure execution boundary.
Dropbox integrated MCP with Dash, its internal knowledge platform, so AI-assisted code review retrieves the threat model and security requirements for a pull request and checks the implementation against design intent.
Security design context rides the same protocol as a tool call, reaching the review step where it is usually missing.
Euclid-MCP puts SWI-Prolog behind a standard MCP tool interface. It introduces Euclid-IR, an engine-agnostic, LLM-generatable representation of Horn-clause logic, and a translate-run-inspect-repair loop that keeps proof traces visible to the client.
On a compliance-sensitive IT security benchmark, LLMs alone hold up on small knowledge bases but hallucinate systematically as they grow, while Euclid-MCP returns exact answers with lower latency and more compact output. The authors argue semantic RAG is structurally unsuited to rule enforcement.
Also relevant to Agents reach the outside world through fragile, ad-hoc integrations
A Show HN search MCP uses Cloudflare AI Search to index repositories and other material, so an agent can retrieve project-specific reference information instead of relying on what is already in its context. It is AGPL-3.0 and includes a web widget for end users.
Retrieval over a team's own material becomes one more MCP server rather than a custom RAG integration per agent.
TaskPeace, a Show HN project, is a task queue that AI coding agents pull work from over MCP.
The protocol carries work distribution, not only a tool call or a data fetch, so a fleet of agents can share one queue through the interface they already speak.
Mozilla launched an MDN MCP service. Inspired by it, Simon Willison converted the mdn/browser-compat-data repository into a ~66MB SQLite database (simonw/browser-compat-db) so the data can be queried directly.
MCP carries reference knowledge, not only actions, and community spinoffs repackage the same data in queryable form.
Elastic open-sourced Atlas, an Elasticsearch-based system that keeps three categories of memory for agents, integrates through MCP, and isolates memories per user. It scored 0.89 Recall@10 on question answering (vendor-reported).
Agent memory becomes another MCP server, so any MCP client can share the same memory store.