From the spec:

https://modelcontextprotocol.io/specification/2025-03-26/ser...

“ For trust & safety and security, there SHOULD always be a human in the loop with the ability to deny tool invocations.

Applications SHOULD:

Provide UI that makes clear which tools are being exposed to the AI model Insert clear visual indicators when tools are invoked Present confirmation prompts to the user for operations, to ensure a human is in the loop”

keep in mind that we have "vibe coding" now, where the goal is exactly to _not_ have a human in the loop (at least not constantly).

Notable that they used SHOULD there, where they use MUST elsewhere in the same document.

Thanks for the reference though, I'll quote that in my article.

How does MCP not use existing standards when the reference transport is SSE on HTTP with a JSON RPC payload?

I disagree on the advantages of wisdom as these days I’m thinking the opposite:

1) Lack of wisdom leads to reinvention of the wheel. How many programming languages are there only now doing things the same way as 30 years ago? What is novel versus an unnecessary re-invention?

I started studying Tcl code from back in the late ‘90’s and honestly was surprised. Hell, many people don’t even know what macports is even though homebrew isn’t much but an attempt to reinvent macports with a “cool” spin.

2) Societal language and general problem solving skills are deteriorating. Language, and mathematics evolve ever so slowly, and yet emphasis on their importance is reduced in favor of the whims of technological advancement.

I would rather hire someone with the slow-developing, traditional skills, than the new-age fads.

In addition, with the advances in AI the only people worth hiring will be the ones with traditional education—and the wise, classically trained among our elders will be evermore important.

> How many programming languages are there only now doing things the same way as 30 years ago?

Similar thing in abstract, but differently in practice and it does matter a lot.

Yet what we’re seeing on the web with Typescript components turning to a pretty version of MFC minus the right/middle-click capability. The “single-page app” becoming a defacto standard mode of development.

Looking at the Fluent design React components just makes me wonder: this is progress from the desktop metaphor designed in the 90’s? What are we trying to achieve?

Then, I take a step back and realize that the 20-something’s from today don’t generally know what that is because they are cloud native.

JavaScript, HTML, and CSS have changed a lot since 2012.

I think the problem is folks tend to think like engineers with all their widgets (e.g desktop development in the browser). Even Microsoft is going full TypeScript mode.

Web development is DESIGN first. Think of it like a design project and suddenly the entire workflow changes.

The CSS spec today makes all this stuff super easy people just don’t spend the time actually learning.

In my opinion the Laravel and Rails developers get this right.

How is the MCP API bad? It uses simple and widely available standards-based transports while still allowing custom transport implementations, along with a simple API that can be used easily without any libraries, in any programming language under the sun?

I think people often think of their specific use-case and tend to forget the bigger picture. MCP does not force one transport or the other and that is great—use any transport you want as long as it uses JSON RPC as the payload.

The two built in transports are also extremely minimalistic and for SSE transport use regular HTTP—no need for web sockets or other heavier dependencies because SSE events are lightweight and broadly supported.