alt Hacker NewsAs someone who has never used MCP, or allowed an AI to directly talk to APIs, putting something between a model and a service just seems like common sense. If nothing else, it presents an opportunity to tightly control what the AI is allowed to do with external services, especially if the MCP code is outside of the AI's context. I would go as far as to say it's a necessary security measure.
Replies
ActorNightly • today at 6:42 PM
The better solution for security is sandbox execution. Most agents used in practice, if given terminal access, can find ways to get around most of the MCP restrictions.
dominotw • today at 2:19 PM
well if you realease an api you should make sure its usable for ai out of box without 'something in between'. You should always assume ai might be directly calling your api.
➕ show 2 replies
The service itself needs to control what the agent can access.
Relying on an intermediary to provide access controls, and that agents will never access the service directly, seems dangerous and naive.