Thoughts after reading the MCP specification
MCP is a promising step toward standardized tool use, but it leaves hard questions about state, identity, and trust unanswered.
The Model Context Protocol (MCP) standardizes how agents discover and call tools. This is valuable. But reading the spec, I kept noticing what it does not say.
It does not say how an agent proves its identity to a tool. It does not say how tools negotiate permissions. It does not say what happens when an agent's context exceeds the server's expectations. It does not say how to audit a long chain of tool calls across multiple servers.
These are not criticisms. A protocol has to start somewhere. But they are research opportunities. The next layer of agent infrastructure will need to answer these questions, and I suspect the answers will look more like distributed systems than like prompt engineering.