- A Stack Overflow essay argues that MCP, the shared protocol for connecting AI agents to tools, has been standardized faster than the infrastructure for running it.
- It cites a 2026 study that checked 7,973 remote MCP servers and found 40.55% exposed tools without authentication.
- Leaders should ask which MCP servers their teams run, who holds the credentials, and whether an agent's actions can be reconstructed.
Connecting an AI agent to a company's tools has become the easy part. Keeping that connection secure, steady and traceable is now where the effort goes. That is the argument of a new essay on the Stack Overflow blog, and it deserves a hearing from anyone who funds AI projects.
The essay, published October 15, 2026, is about MCP. That is a shared protocol that lets AI models call tools such as code repositories, databases and internal APIs. The author builds Hexum.dev, a hosted MCP endpoint for coding agents. So this is a practitioner's view, not independent research.
The adoption it describes is real. Claude Code, Cursor, Codex and VS Code all speak MCP. Vendor-hosted endpoints exist for GitHub, Linear and Notion. The author says the official top-tier developer kits for MCP are downloaded close to 500 million times a month.
A standard message is not a standard operation
In a demo, the path is short. An agent talks to a client, the client talks to an MCP server, and the server calls a tool. In production, the author says, more layers appear. There are authentication, gateways, many servers, rate limits, and permissions that differ by person and task. Each layer can fail on its own.
The protocol fixes the format of the messages. It leaves login, retries, secret storage and health checks to each team. The author reports seeing the same pieces rebuilt again and again in separate codebases.
Local servers show the cost. They run on a developer's own machine and are easy to start. At team scale, versions drift and credentials sit on different laptops. One person's setup breaks in a way another's does not.
Hosted servers fix some of that but add questions about authentication, latency, uptime and vendor dependence. The author says neither model is automatically better. July 2026 changes to the specification removed protocol-level sessions and the initialize handshake. A remote server can now scale like an ordinary web service. The author says this does not remove the need for authentication or authorization.
The login gap
The essay cites a 2026 study that checked 7,973 remote MCP servers that were running. Roughly two in five, 40.55%, let callers use their tools without any authentication. The author says the fault lies in how servers are set up, not in the protocol itself. The author adds that this is the problem teams actually meet in practice. The essay does not name the study here, so treat the figure as cited, not independently checked.
Why does this matter more than for an ordinary API? An agent reads text, may treat some of it as instructions, and then acts on outside systems. The author names several ways this goes wrong. Hidden instructions can steer the agent. Permissions can be set too wide. Tool descriptions can be tampered with. Secrets can pass through arguments or results. The servers themselves can be a weak link in the supply chain.
The author's answer is least privilege. An agent shown every available tool can be talked into using ones it should never touch. The author also calls for human approval of destructive actions.
Too many tools, too much context
Loading every tool description into the model on every turn costs money and focus. The author says that with 50, 100 or several hundred tools, selection accuracy can drop. Names can collide and vague descriptions make it worse.
One response is progressive discovery. The model searches for the tools it needs instead of holding them all. The author says current client guidance points this way, though the pattern is not yet universal. It is also still open whether the selection logic belongs in the client, a gateway, the server or the model.
Choosing context is a design step
The author gives a separate example from the author's own product. It concerns what code a coding agent sees, not how tools are loaded. Hexum.dev selects the relevant parts of a repository instead of sending every file.
On a published 24-task benchmark built from MBPP and HumanEval, the context sent to the model fell from 220,393 tokens to 27,352. All official tests still passed. This is a vendor figure on a small test. The author says the observation matters more than the number: once context selection is a deliberate step, new constraints appear.
When an agent fails halfway
A person who sees an error stops. An agent may carry on. The essay contrasts an agent that fails while reading documentation with one that fails while creating cloud resources or opening pull requests. The second leaves partial work and inconsistent state. The protocol does not supply the fix, so teams need safe retries and ways to undo steps.
Debugging needs a record of what the model saw, which tool it picked, and what it did next. Standard tracing is starting to appear. OpenTelemetry's GenAI conventions include MCP spans, and the official Python SDK now emits them by default. The author calls adoption early.
What this shows
The lesson here is that a standard makes connection cheap but does not make trust cheap. When linking a tool is easy, the control moves to the layer between the agent and the system. That layer is where login, permissions and records live.
The author sees teams building that layer separately in different codebases. WebPulse reads this as a sign that ownership is unclear. The essay does not say how many companies leave it unowned.
The author offers a parallel. HTTP standardized how systems talk, yet the industry still built CDNs, gateways and identity systems around it. The author calls the proposed stack a hypothesis and says it is not yet settled where these functions will live.
Questions to put to your team
Ask which MCP servers are in use, and whether each runs locally or remotely. Ask whether any expose tools without authentication. Ask who holds the credentials and where they are stored. Ask which agent actions need human approval, especially destructive ones. Ask whether your team could reconstruct a failed agent run from its logs. Finally, ask who owns this layer.
In the author's framing, the hard work has moved. It no longer lies in making the connection. It lies in everything that surrounds it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Stack Overflow.
