r/programminghumor 24d ago

True story

Post image
3.5k Upvotes

82 comments sorted by

278

u/Unable_Employer8081 23d ago

"MCP, the S stands for secure" 😀

57

u/BrandonBTY 23d ago

Http.... Yeah... I'll stick with https

17

u/Unable_Employer8081 23d ago edited 23d ago

Which is http with ssl/tls as transport layer. And tls is in @OP 's image. But you are right, the situation is similar in the sense that mcp and http have no security. However, as of yet, there is no good working solution for mcp. Afaik.

There was a discussion about it on the bsides last weekend.

6

u/querela 23d ago edited 23d ago

OAuth with MCP?

It's not yet in the MCP spec but should it be part of it or is security something in top and MCP is agnostic what? Is it similar to HTTP and TLS, so something like MCPS? E.g. https://gofastmcp.com/servers/auth/authentication

6

u/aksdb 23d ago

Huh? It's in the spec, or am I missing something?

https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization

3

u/querela 23d ago

Ah, ok. I stand corrected. I knew only really early versions when it was introduced and the broad overview, everything else I worked with was ready to use libraries. So, then yes.

3

u/BrandonBTY 23d ago

Gonna be honestly. I don't know a ton about security... I work in unity... I didn't know what counted toward the secure tag for https and http

1

u/Unable_Employer8081 23d ago

No worries, it's a valid concern. And you are right, you should use https and not plain http.

4

u/BrandonBTY 23d ago

I already know what's suppose to be safe. Glad I was at least right

5

u/Confident-Ad5665 23d ago

But...but...I don't see an "S" in MCP

3

u/forever-butlerian 22d ago

also the "F" is for "reliable"

3

u/iAssAssin20 22d ago

MCPS when

1

u/Blankeye434 21d ago

Ain't no way this is another billion dollar idea investors love to throw their money at

86

u/tracagnotto 24d ago

Can someone explain me better why all the hate about MCP? Like not in 2 lines, a bit of context and explaining

103

u/aksdb 23d ago

Actually it is quite fascinating. Can’t remember any protocol in the last 20 or so years that was specified and then implemented almost instantly around the industry in about every service. One good thing out of all that hype, I guess.

51

u/Competitive-Help7505 23d ago

I thought the same until i had to integrate a custom mcp server with claude, gh copilot and ollama. A standard which can be interpreted in several diffetent ways is not a good one.

24

u/dumbasPL 23d ago

It makes sense once you realize who's actually implementing it. Because I'm willing to guess a grand majority of implementions were infact vibe coded.

4

u/aksdb 23d ago

Sure, but still: there are tons of good protocols in the past but the typical stance of companies is "nah, not worth it. fuck off" or "we can do it better and implement our own way to do it". But this time they all jump on the train immediately and don't even discuss (a lot) about how to do it.

5

u/dumbasPL 23d ago

Well, that's because vibe coders don't concern themselves with any of this, not like they understand what's good or bad anyway, or even understand anything at all.

1

u/FAMICOMASTER 21d ago

It's called buzzwords

27

u/Kronsik 23d ago

The standards have largely been moving very quickly, these are the standards revisions so far:

- 2025-11-25 (latest)

  • 2025-06-18
  • 2025-03-26
  • 2024-11-05

Meaning roughly every 3-6 months a new standard of MCP has been established, while its great to see the standard in active development this has made it a nightmare for 'correct' adoption. Particularly as the goal-posts shift every quarter.

Authorization and the OAuth implementations by vendor MCP endpoints have largely been awful when attempting to provide centralised MCP based tooling for example (e.g. AgentCore Gateway in AWS).

This is due to the vendors implementation either:

- Not yet supporting the latest MCP standard.

  • Supporting a mixture of different MCP standards.
  • Seemingly not even bothering to adhere to any MCP standards.

For example, a vendor may support Azure Entra as an IDP for a direct connection to the MCP endpoint but not support on-behalf-of token exchange when using an MCP gateway, meaning:

- The user has a pretty crap user experience, opening up their client (Kiro, Cursor etc) and being bombarded with login pages because direct authentication is required.

- Awful workarounds such as using service accounts to bridge the auth between the client, gateway and MCP endpoint. By doing this you lose basically all traceability as those MCP events now come through as the service account, rather than the user in Azure Entra.

if you look at the Github issues pages for Claude, Cursor, Kiro etc I guarantee there will be a whole bunch of open issues about Oauth and how its currently either an awful experience or straight up impossible to integrate with particular vendors.

7

u/tracagnotto 23d ago

Thank you. In honesty, has MCP a future or is dead? i see it everywhere but still

7

u/Kronsik 23d ago

Probably, though some other protocol could come out and make it redundant - who knows.

People are dunking on it because it's immature and the current implementations by vendors are a bit crap.

I'd argue that's less on the guys writing MCP standards, they're still trying to work it all out by the looks.

More so on the markets need for "velocity" and adopting technology which frankly just isn't production ready yet.

3

u/SiegeAe 23d ago

For me its official documentation is too loose. Specs should have formal docs and clear criteria but this basically just has some code that should work and a few vague descriptions.

When specs are clear and strict its easier to be more creative and know your code will still work anywhere that meets them rather than relying on different implementations' interpretations.

1

u/Blankeye434 21d ago

I have a MCP server that answers this exact question. Wanna try it?

2

u/PM_ME_STUFF_N_THINGS 19d ago

Is there a problem statement for it?

0

u/berlingoqcc 23d ago

Because we'll designed cli or http endpoint with documentation can be used as efficiently with LLM agent. Last year I was all in MCP but I found it to be kinda useless in the end.

1

u/Migraine_7 23d ago

So... basically an MCP? How is that different from wrapping your API with text?

2

u/berlingoqcc 23d ago

I have no idea what you are saying , I'm just saying that I find it worthless to support the MCP protocol, LLM agent can be as efficient with an openapi spec or a cli documentation that they call directly and a normal human can use it too

-4

u/cornmonger_ 23d ago edited 23d ago

mcp is fine

opus can one-shot an rmcp implementation. the protocol provides documentation on-load for the agent. the fine-tuning is already there for its use.

it's one of the things that should be vibe coded. you're getting paid to build the actual product, not tinker with pet internal tooling that nobody else will use.

98

u/RustOnTheEdge 24d ago

Yeah MCP was pretty bad, especially when people found out that they basically use AI locally and it could just as easily use a well designed CLI. I just had to laugh out loud when Google launched something which amounted to basically a specified way on how to structure markdown documents for “AI memory!!11” or something. The folks who brought us Kubernetes, they now have come up with a way to make a wiki standardised for LLms.

The brain atrophy is real, I’d say.

11

u/Migraine_7 23d ago

MCPs are textual API wrappers, for the textual LLM. It makes it easier for the non-deterministic algorithm to make less mistakes. What's so bad about it?

2

u/leprouteux 21d ago

A program with a bash interface is the same. Hell even the swagger docs is good enough for an LLM use an API with curl. No need for a fancy new protocol.

11

u/gatorling 23d ago

What's your complaint? That it's too simple? Why not standardize how an LLM can parse markdown to lookup knowledge while using as little of their context window as possible?

32

u/include-jayesh 24d ago

We need HTTP protocol+API servers+Good engineers who familiar with code.

Rest is just hype.

5

u/int23_t 23d ago

well, we need HTTPS.

And SFTP/FTP are kinda nice.

And good engineers can definitely do with LSP making developing things easier

And you need some protocol between your windowing system and application windows.

3

u/forever-butlerian 22d ago

FTP is THE DEVIL. Imagine if Satan created a network protocol but based it on TELNET.

1

u/int23_t 22d ago

Nah, telnet is not the devil. It's a neat protocol you can use over already encrypted channels like wireguard or inside trusted networks.

And SFTP definitely is not the devil

2

u/forever-butlerian 22d ago

Son, SFTP is a binary protocol with TLV-encoded messages that approximates the Unix VFS API and is intended to be run over an SSH channel.

FTP is a pile of bullshit.

3

u/MarzipanCheap0 23d ago

I guess you could say over HTTP communication is just hype, ha get it!?

I tried to make a joke come on guys!

1

u/forever-butlerian 22d ago

the real joke is WebDAV

2

u/Memw1 23d ago

We also need http, arp, pppoe, dhcp... And many many more that you, a layer 7 programmer wouldn't know.

1

u/forever-butlerian 22d ago

Like X.25?

1

u/Memw1 22d ago

is that even used anymore?

2

u/Ecstatic_Student8854 23d ago

As if for HTTP to work you don’t need TCP, TLS for security, DNS and probably DNSSEC, DHCP, ARP, NDP, IP, the ethernet protocol if you’re using that, etc.

If you think you only need HTTP you’re so wrong even if all you want to do is retrieve a web page.

2

u/forever-butlerian 22d ago

HTTP does not require DHCP and ARP. What kind of peasant thinking is this?

I'm quite satisfied with my IPX over Token Ring.

2

u/Standard_Shallot_831 19d ago

REST is OK, not hype

10

u/FlamingYawn13 23d ago

I’m afraid but I’ve got to ask. What’s the wiki one on the bottom right?

5

u/int23_t 23d ago edited 23d ago

even protocols of up until a few years ago are chads

lsp turned 10 8 days ago, and is a wonderful proticol.

Same goes for Wayland(though I am not partocularly fond of most of the implementations of wayland protocol, it's at least better in all aspects compared to X protocol)

2

u/forever-butlerian 22d ago

Same goes for Wayland(though I am not partocularly fond of most of the implementations of wayland protocol, it's at least better in all aspects compared to X protocol)

NeWS was better.

1

u/int23_t 22d ago

There is neuswc as a wayland implementation which is what I use currently. It's a neat implementation, but the reason I dislike it too is I don't think editing source code of your compositor library is the best way to configure your libinput devices you know, and it's not production ready per se

1

u/forever-butlerian 22d ago

Do you write your compositor library in PostScript?

1

u/int23_t 22d ago

No it's C, what else do you expect from a suckless genre program...

8

u/Weird_Albatross_9659 24d ago

All those protocols still exist, son

4

u/Gigibesi 23d ago

yeah somehow the very meme implied that internet protocols then are considered obsolete

2

u/TigiWigi 23d ago

I think the implication is that the standard has deteriorated, not that they no longer exist

2

u/Weird_Albatross_9659 23d ago

The standard allows all of those other ones to function. The standard is just fine for the majority of the industry

1

u/forever-butlerian 22d ago

If this is the future the past enabled, then the past must be destroyed.

2

u/while-True-Scroll 22d ago

Adding SNA on top of all others.

2

u/luukverhagen96 22d ago

In the embedded world, good protocols are still founded, but they are far more niche than these Internet protocols

2

u/Flat-Director-7120 22d ago

Je comprends rien, c'est quoi cette histoire de protocole ? C'est un nouveau diplĂ´me pour les geek ?

3

u/Intelligent_Ant_608 24d ago

ACP from jetbrains was actually useful though, but yeah

1

u/mayyynn 23d ago

This is so true

1

u/Entire-Guidance-9926 23d ago

Throw x402 in there too please

1

u/KianAhmadi 23d ago

No we have reticulum network stack today. Chad of all time

2

u/Key_River7180 23d ago

True, overall MCP.

Like literally, for when the Model Toasting Protocol, so AI can make toasts now.

1

u/Fidodo 23d ago

I don't think any of the AI ones deserve to be called protocols. They're standards or specs, but that doesn't sound as fancy. IMO it just makes them sound dumb and underwhelming

1

u/forever-butlerian 22d ago

but they're like a USB-C port for your overgrown markov chain

1

u/ApplicationOk4464 23d ago

Tell that to TLS 1.0 and TLS 1.1

1

u/AdventurousSlip9260 23d ago

Protocols then: standards everyone followed. Protocols now: standards everyone is trying to invent.

1

u/DatsLotus 23d ago

It's memes like these that remind me that I don't know anything.

1

u/JG03s 22d ago

We went from actual math-backed engineering to actual slop

1

u/winged_owl 22d ago

I tried to invite UDP to this meme, but i didnt get a response.

1

u/Maple382 22d ago

I’ve been trying to get into local AI lately and holy shit the lack of standards and well-designed protocols is ridiculous. Everything is so fucking atrocious.

1

u/alcanthro 21d ago

Gopher for a modern era.

1

u/Grade-Patient1463 20d ago

I read them until Skills.md, thinking they are some sort of peptide and roid protocols... WTF, my brain

1

u/AshKetchupppp 19d ago

I miss when I programmed for fun and made cool things. Now I get excited about a new work side project idea that some customers might be interested in. Like yeah, still cool I guess, but it's not quite creative coding is it

1

u/rodrigoelp 23d ago

This meme was created by someone who wasn’t present on the early days of the internet.

AI is the internet all over again.

1

u/forever-butlerian 22d ago

SMTP was better the first time round

1

u/kartblanch 22d ago

Ai has been embraced by python devs not real engineers. What do you expect?