MCP

Model Context Protocol — Anthropic’s open protocol (Nov 2024) for connecting models to tools, resources, and prompts. The elevator pitch that stuck: “USB-C for AI” — one standardized plug between any client (harness/IDE/app) and any server (database, API, filesystem), so integrations are written once against the protocol instead of N times against each harness.

The shape

• Primitives: tools (model-invoked functions), resources (readable data, URI-addressed), prompts (parameterized templates), plus sampling (server asks client’s model) and roots/elicitation (client context back to server).
• Transports: stdio (local) and Streamable HTTP (remote; replaced the old HTTP+SSE dual-endpoint setup in the 2025-06 spec) — one endpoint, optional upgrade to SSE streams, resumability, session IDs. OAuth 2.1 + resource-server semantics for remote servers per the 2025-11 authorization updates.
• The registry question (discovery beyond word-of-mouth URLs) was the open ecosystem gap being worked through 2026.

The real field problems (the critique that earned)

1. Tool-dumping — servers built for harnesses that “dump tools into context” and return text blobs; token cost paid on every request whether tools are used or not. (MCP reconsidered — the Pi team’s arc from loudest skeptics to shipping MCP in core.)
2. Composition — chaining tool calls is awkward; the Pi/Codemode answer is an interpreter-side JS sandbox orchestrating calls with structured returns (“closer to OpenAPI with intelligent tool discovery”). CLIs win because agents compose them with shell — MCP needs the same composability.
3. Security — prompt injection through tool results, confused-deputy servers, DNS rebinding against local stdio servers; confused Piper’s “MCP security is a superdeep rabbit hole”; token-passing patterns (resource servers never see the token — see the captured template below).

The vault’s MCP instances

• Hermes Agent — native MCP client (config.yaml servers → auto tool discovery); the mcporter CLI bridge for ad-hoc calls; the mcp skill family.
• Pi agent harness — the reversal arc (MCP reconsidered): “no MCP” → MCP in core once composition (Codemode) made it earn its seat.
• streamable-mcp-server-template (OSS) (141★, TS; via @_overment) — production-ready server template matching the latest spec: Streamable HTTP on Node (Hono) or Cloudflare Workers, OAuth 2.1 resource-server (your code never receives the token), multi-tenant sessions, tool/resource/prompt registration, AES-256-GCM token encryption, Host/Origin checks, no-internal-errors policy, tests on Bun + Workers. The reference shape for “MCP server done right” in 2026 — the read-side counterpart to the critique notes.
• DuckDB’s MCP server (385 components lane, Embedded databases), omnigent/nfSensei API-first kin — MCP surface as product requirement.

The pattern

MCP is the standardized boundary play in the agent stack — same genus as Agent Client Protocol (client↔agent instead of agent↔tool): thin protocol layers where incumbency + ergonomics decide, not raw power. The open questions worth tracking: does composition move interpreter-side (Codemode/WASM) or stay harness-side? Does discovery centralize (registry) or stay social (READMEs + packages)? And does the CLI-with-README pattern (CLIs for agents) keep absorbing the long tail of simple integrations MCP currently serves?

Related: MCP reconsidered · Agent Client Protocol · CLIs for agents · Agent-accessible product (schemas as the contract)