[SPOILERS] 20 Minutes into the MCP future

The talk starts from a problem: APIs were built for humans who read documentation and experiment, while AI agents need to discover tools, authentication and parameters on their own. The speaker uses a short example of a language model failing to answer a question about recent events to show why models need access to outside context, then compares the tool-calling schemas used by different model vendors, which each describe functions differently.

The middle section introduces the Model Context Protocol as an open, JSON-RPC based standard first published in late 2024. It explains the three roles in the design: a host such as a desktop assistant or code editor, a client that the host creates for each server, and a server that exposes tools and their parameters. The talk covers local transport over standard input and output, remote transport over HTTP, and how a model can query several servers in turn to gather context. Recent additions such as remote servers and OAuth are noted, along with a registry for finding servers and a brief mention of agent-to-agent protocols.

The closing part focuses on security. Examples include directory traversal through unchecked file paths, command injection caused by concatenating shell strings, wrapping a whole API as one tool that can trigger destructive actions, and prompt injection hidden in documents or tool descriptions. The speaker's advice is to separate read and write permissions, keep the blast radius small, require human approval for actions that cannot be reversed, and apply existing API security guidance until MCP-specific guidance matures.