Published on

An MCP skeptic's diary

Authors

Why all the hate?

  1. MCP is powerful. But we’re seeing history repeat itself — with all the speed of AI agents, and none of the maturity of API security.
  2. The core issue is that MCP, in its current stage, shares a characteristic with many foundational internet protocols like Telnet or early HTTP: It wasn't built with a security-first mindset, making it insecure by design from a practical standpoint.
  3. MCP itself isn’t insecure by design, but it increases the attack surface by pushing LLMs closer to tools and sensitive data. The real issue is that current LLMs remain vulnerable to prompt injections, and most popular agent systems lack strong guardrails.
Discuss on Twitter • View on GitHub