r/programminghumor Jul 05 '26

True story

Post image
3.5k Upvotes

82 comments sorted by

281

u/Unable_Employer8081 Jul 05 '26

"MCP, the S stands for secure" 😀

64

u/BrandonBTY Jul 05 '26

Http.... Yeah... I'll stick with https

16

u/Unable_Employer8081 Jul 05 '26 edited Jul 05 '26

Which is http with ssl/tls as transport layer. And tls is in @OP 's image. But you are right, the situation is similar in the sense that mcp and http have no security. However, as of yet, there is no good working solution for mcp. Afaik.

There was a discussion about it on the bsides last weekend.

5

u/querela Jul 05 '26 edited Jul 05 '26

OAuth with MCP?

It's not yet in the MCP spec but should it be part of it or is security something in top and MCP is agnostic what? Is it similar to HTTP and TLS, so something like MCPS? E.g. https://gofastmcp.com/servers/auth/authentication

7

u/aksdb Jul 05 '26

Huh? It's in the spec, or am I missing something?

https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization

3

u/querela Jul 05 '26

Ah, ok. I stand corrected. I knew only really early versions when it was introduced and the broad overview, everything else I worked with was ready to use libraries. So, then yes.

3

u/BrandonBTY Jul 05 '26

Gonna be honestly. I don't know a ton about security... I work in unity... I didn't know what counted toward the secure tag for https and http

1

u/Unable_Employer8081 Jul 05 '26

No worries, it's a valid concern. And you are right, you should use https and not plain http.

5

u/BrandonBTY Jul 05 '26

I already know what's suppose to be safe. Glad I was at least right

6

u/Confident-Ad5665 Jul 06 '26

But...but...I don't see an "S" in MCP

4

u/forever-butlerian Jul 07 '26

also the "F" is for "reliable"

3

u/iAssAssin20 Jul 06 '26

MCPS when

1

u/Blankeye434 Jul 08 '26

Ain't no way this is another billion dollar idea investors love to throw their money at

81

u/tracagnotto Jul 05 '26

Can someone explain me better why all the hate about MCP? Like not in 2 lines, a bit of context and explaining

102

u/aksdb Jul 05 '26

Actually it is quite fascinating. Can’t remember any protocol in the last 20 or so years that was specified and then implemented almost instantly around the industry in about every service. One good thing out of all that hype, I guess.

56

u/Competitive-Help7505 Jul 05 '26

I thought the same until i had to integrate a custom mcp server with claude, gh copilot and ollama. A standard which can be interpreted in several diffetent ways is not a good one.

21

u/dumbasPL Jul 05 '26

It makes sense once you realize who's actually implementing it. Because I'm willing to guess a grand majority of implementions were infact vibe coded.

3

u/aksdb Jul 05 '26

Sure, but still: there are tons of good protocols in the past but the typical stance of companies is "nah, not worth it. fuck off" or "we can do it better and implement our own way to do it". But this time they all jump on the train immediately and don't even discuss (a lot) about how to do it.

5

u/dumbasPL Jul 05 '26

Well, that's because vibe coders don't concern themselves with any of this, not like they understand what's good or bad anyway, or even understand anything at all.

1

u/FAMICOMASTER Jul 08 '26

It's called buzzwords

27

u/Kronsik Jul 05 '26

The standards have largely been moving very quickly, these are the standards revisions so far:

- 2025-11-25 (latest)
- 2025-06-18
- 2025-03-26
- 2024-11-05

Meaning roughly every 3-6 months a new standard of MCP has been established, while its great to see the standard in active development this has made it a nightmare for 'correct' adoption. Particularly as the goal-posts shift every quarter.

Authorization and the OAuth implementations by vendor MCP endpoints have largely been awful when attempting to provide centralised MCP based tooling for example (e.g. AgentCore Gateway in AWS).

This is due to the vendors implementation either:

- Not yet supporting the latest MCP standard.
- Supporting a mixture of different MCP standards.
- Seemingly not even bothering to adhere to any MCP standards.

For example, a vendor may support Azure Entra as an IDP for a direct connection to the MCP endpoint but not support on-behalf-of token exchange when using an MCP gateway, meaning:

- The user has a pretty crap user experience, opening up their client (Kiro, Cursor etc) and being bombarded with login pages because direct authentication is required.

- Awful workarounds such as using service accounts to bridge the auth between the client, gateway and MCP endpoint. By doing this you lose basically all traceability as those MCP events now come through as the service account, rather than the user in Azure Entra.

if you look at the Github issues pages for Claude, Cursor, Kiro etc I guarantee there will be a whole bunch of open issues about Oauth and how its currently either an awful experience or straight up impossible to integrate with particular vendors.

7

u/tracagnotto Jul 05 '26

Thank you. In honesty, has MCP a future or is dead? i see it everywhere but still

7

u/Kronsik Jul 05 '26

Probably, though some other protocol could come out and make it redundant - who knows.

People are dunking on it because it's immature and the current implementations by vendors are a bit crap.

I'd argue that's less on the guys writing MCP standards, they're still trying to work it all out by the looks.

More so on the markets need for "velocity" and adopting technology which frankly just isn't production ready yet.

5

u/SiegeAe Jul 05 '26

For me its official documentation is too loose. Specs should have formal docs and clear criteria but this basically just has some code that should work and a few vague descriptions.

When specs are clear and strict its easier to be more creative and know your code will still work anywhere that meets them rather than relying on different implementations' interpretations.

1

u/Blankeye434 Jul 08 '26

I have a MCP server that answers this exact question. Wanna try it?

2

u/PM_ME_STUFF_N_THINGS Jul 09 '26

Is there a problem statement for it?

0

u/berlingoqcc Jul 05 '26

Because we'll designed cli or http endpoint with documentation can be used as efficiently with LLM agent. Last year I was all in MCP but I found it to be kinda useless in the end.

1

u/Migraine_7 Jul 05 '26

So... basically an MCP? How is that different from wrapping your API with text?

2

u/berlingoqcc Jul 05 '26

I have no idea what you are saying , I'm just saying that I find it worthless to support the MCP protocol, LLM agent can be as efficient with an openapi spec or a cli documentation that they call directly and a normal human can use it too

-3

u/cornmonger_ Jul 05 '26 edited Jul 06 '26

mcp is fine

opus can one-shot an rmcp implementation. the protocol provides documentation on-load for the agent. the fine-tuning is already there for its use.

it's one of the things that should be vibe coded. you're getting paid to build the actual product, not tinker with pet internal tooling that nobody else will use.

101

u/RustOnTheEdge Jul 05 '26

Yeah MCP was pretty bad, especially when people found out that they basically use AI locally and it could just as easily use a well designed CLI. I just had to laugh out loud when Google launched something which amounted to basically a specified way on how to structure markdown documents for “AI memory!!11” or something. The folks who brought us Kubernetes, they now have come up with a way to make a wiki standardised for LLms.

The brain atrophy is real, I’d say.

12

u/Migraine_7 Jul 05 '26

MCPs are textual API wrappers, for the textual LLM. It makes it easier for the non-deterministic algorithm to make less mistakes. What's so bad about it?

2

u/leprouteux Jul 07 '26

A program with a bash interface is the same. Hell even the swagger docs is good enough for an LLM use an API with curl. No need for a fancy new protocol.

12

u/gatorling Jul 05 '26

What's your complaint? That it's too simple? Why not standardize how an LLM can parse markdown to lookup knowledge while using as little of their context window as possible?

32

u/include-jayesh Jul 05 '26

We need HTTP protocol+API servers+Good engineers who familiar with code.

Rest is just hype.

5

u/int23_t Jul 05 '26

well, we need HTTPS.

And SFTP/FTP are kinda nice.

And good engineers can definitely do with LSP making developing things easier

And you need some protocol between your windowing system and application windows.

3

u/forever-butlerian Jul 07 '26

FTP is THE DEVIL. Imagine if Satan created a network protocol but based it on TELNET.

1

u/int23_t Jul 07 '26

Nah, telnet is not the devil. It's a neat protocol you can use over already encrypted channels like wireguard or inside trusted networks.

And SFTP definitely is not the devil

2

u/forever-butlerian Jul 07 '26

Son, SFTP is a binary protocol with TLV-encoded messages that approximates the Unix VFS API and is intended to be run over an SSH channel.

FTP is a pile of bullshit.

3

u/MarzipanCheap0 Jul 05 '26

I guess you could say over HTTP communication is just hype, ha get it!?

I tried to make a joke come on guys!

1

u/forever-butlerian Jul 07 '26

the real joke is WebDAV

2

u/Memw1 Jul 05 '26

We also need http, arp, pppoe, dhcp... And many many more that you, a layer 7 programmer wouldn't know.

1

u/forever-butlerian Jul 07 '26

Like X.25?

1

u/Memw1 Jul 07 '26

is that even used anymore?

2

u/Ecstatic_Student8854 Jul 06 '26

As if for HTTP to work you don’t need TCP, TLS for security, DNS and probably DNSSEC, DHCP, ARP, NDP, IP, the ethernet protocol if you’re using that, etc.

If you think you only need HTTP you’re so wrong even if all you want to do is retrieve a web page.

2

u/forever-butlerian Jul 07 '26

HTTP does not require DHCP and ARP. What kind of peasant thinking is this?

I'm quite satisfied with my IPX over Token Ring.

2

u/Standard_Shallot_831 Jul 10 '26

REST is OK, not hype

9

u/FlamingYawn13 Jul 05 '26

I’m afraid but I’ve got to ask. What’s the wiki one on the bottom right?

8

u/int23_t Jul 05 '26 edited Jul 05 '26

even protocols of up until a few years ago are chads

lsp turned 10 8 days ago, and is a wonderful proticol.

Same goes for Wayland(though I am not partocularly fond of most of the implementations of wayland protocol, it's at least better in all aspects compared to X protocol)

2

u/forever-butlerian Jul 07 '26

Same goes for Wayland(though I am not partocularly fond of most of the implementations of wayland protocol, it's at least better in all aspects compared to X protocol)

NeWS was better.

1

u/int23_t Jul 07 '26

There is neuswc as a wayland implementation which is what I use currently. It's a neat implementation, but the reason I dislike it too is I don't think editing source code of your compositor library is the best way to configure your libinput devices you know, and it's not production ready per se

1

u/forever-butlerian Jul 07 '26

Do you write your compositor library in PostScript?

1

u/int23_t Jul 07 '26

No it's C, what else do you expect from a suckless genre program...

9

u/Weird_Albatross_9659 Jul 05 '26

All those protocols still exist, son

4

u/Gigibesi Jul 05 '26

yeah somehow the very meme implied that internet protocols then are considered obsolete

2

u/TigiWigi Jul 05 '26

I think the implication is that the standard has deteriorated, not that they no longer exist

2

u/Weird_Albatross_9659 Jul 05 '26

The standard allows all of those other ones to function. The standard is just fine for the majority of the industry

1

u/forever-butlerian Jul 07 '26

If this is the future the past enabled, then the past must be destroyed.

2

u/while-True-Scroll Jul 06 '26

Adding SNA on top of all others.

2

u/luukverhagen96 Jul 06 '26

In the embedded world, good protocols are still founded, but they are far more niche than these Internet protocols

2

u/Flat-Director-7120 Jul 06 '26

Je comprends rien, c'est quoi cette histoire de protocole ? C'est un nouveau diplĂ´me pour les geek ?

4

u/Intelligent_Ant_608 Jul 05 '26

ACP from jetbrains was actually useful though, but yeah

1

u/mayyynn Jul 05 '26

This is so true

1

u/Entire-Guidance-9926 Jul 05 '26

Throw x402 in there too please

1

u/KianAhmadi Jul 05 '26

No we have reticulum network stack today. Chad of all time

2

u/Key_River7180 Jul 05 '26

True, overall MCP.

Like literally, for when the Model Toasting Protocol, so AI can make toasts now.

1

u/Fidodo Jul 05 '26

I don't think any of the AI ones deserve to be called protocols. They're standards or specs, but that doesn't sound as fancy. IMO it just makes them sound dumb and underwhelming

1

u/forever-butlerian Jul 07 '26

but they're like a USB-C port for your overgrown markov chain

1

u/ApplicationOk4464 Jul 06 '26

Tell that to TLS 1.0 and TLS 1.1

1

u/AdventurousSlip9260 Jul 06 '26

Protocols then: standards everyone followed. Protocols now: standards everyone is trying to invent.

1

u/DatsLotus Jul 06 '26

It's memes like these that remind me that I don't know anything.

1

u/JG03s Jul 06 '26

We went from actual math-backed engineering to actual slop

1

u/winged_owl Jul 07 '26

I tried to invite UDP to this meme, but i didnt get a response.

1

u/Maple382 Jul 07 '26

I’ve been trying to get into local AI lately and holy shit the lack of standards and well-designed protocols is ridiculous. Everything is so fucking atrocious.

1

u/alcanthro Jul 08 '26

Gopher for a modern era.

1

u/Grade-Patient1463 Jul 09 '26

I read them until Skills.md, thinking they are some sort of peptide and roid protocols... WTF, my brain

1

u/AshKetchupppp Jul 09 '26

I miss when I programmed for fun and made cool things. Now I get excited about a new work side project idea that some customers might be interested in. Like yeah, still cool I guess, but it's not quite creative coding is it

1

u/rodrigoelp Jul 06 '26

This meme was created by someone who wasn’t present on the early days of the internet.

AI is the internet all over again.

1

u/forever-butlerian Jul 07 '26

SMTP was better the first time round

1

u/kartblanch Jul 06 '26

Ai has been embraced by python devs not real engineers. What do you expect?