Hacker Remix

Ask HN: Is MCP mature enough to use safely?

6 points by Rooster61 1 week ago | 3 comments

After doing a bit of research and trying to get my head around MCP, I am eager to take advantage of the idea. However, I am skeptical of how usable the approach is as of yet, mainly due to its nascent nature.

My (admittedly oversimplified) understanding is that MCP's purpose is mainly to provide a sort of langua franca for LLM's to tackle agentic tasks without having to write unicorn handlers for every single service in every single language in every single individual API flavor. That sounds great, but my understanding is also that it is incumbent on the provider of that MCP server's datasource/resource to create and maintain the MCP server so that LLM's can take advantage of them. A quick look across the interwebs shows that while there are a TON of MCP severs popping up from IC's, a fraction of them are actually endorsed, much less directly maintained, by the entities that own/run the services an LLM might want to interact with.

This of course presents an issue. Anyone with a greater understanding of software development beyond a junior level should understand that pulling libraries straight out of npm/githublab/whathaveyou carries with it security and privacy risks (yes, even if it's open source, nasty bits can be hidden in one of those 100's of libraries you are shotgunning into your app).

Am I missing something here? It all seems very wild west at the moment with a tremendous amount of hype, and I'd like to not be so skeptical. If it is as I say, how long until the foundation solidifies a bit and we truly do have a solid, mature MCP set to draw from?

muzani 1 week ago

Nope. None of it is. The experimental nature is part of the fun and part of the flex. I think there's little incentive to keep it very stable or safe.

In general, experimental technology tends to take 3 or so years to solidify. But AI is different... models from 6 months ago are already deprecated. Not a lot has ever solidified in this space.

dtagames 1 week ago

I second that. MCP is more of a scaffolding concept than a solution itself. There is no safety in consulting an LLM on anything. What you're building is a RAG app that must coordinate LLM calls and tool calls. Any safety built into that is going to built into your procedural code (in a programming language) and not coming from an LLM, which by itself cannot be "corralled."

MCP is just a way of specifying which user prompts go with which LLM calls and tool calls and provides no safety (or even functionality) of its own.

rglover 1 week ago

IMO, it's wiser to focus on RAG (Retrieval Augmented Generation) and utilizing vector db's as MCP is essentially an abstraction on top of that idea.

In essence, MCP is the next esoteric acronym that can be hyped/used to get attention.

1 week ago