What jumped out at me is how quickly MCP has gone from “interesting Anthropic protocol” to “the thing everyone is quietly building around.” That’s not the same as “solved,” and I think the article is right to resist that implication. The protocol may be spreading fast, but the hard parts have just moved up a level: authorization, user intent, and deciding when an agent should be allowed to act at all.
The part that feels most plausible is the shift from tool calling as a narrow API bridge to MCP as a broader interface layer for agent-era software. That’s a real architectural change. If your assistant is going to work across Google Workspace, Microsoft 365, internal systems, and a pile of SaaS apps, then “just give the model another function” stops being enough. You need some shared convention for capability discovery, permissions, and where the data lives.
But I wouldn’t overread the enthusiasm for standardization. Standards often get praised exactly when the ecosystem is still messy. The article’s “MCP Tasks” idea is the interesting bit to me, because it hints at a future where agents handle long-running work and handoffs instead of only making single-shot tool calls. That feels like the right direction. It also sounds like the place where things can get ugly fast if the security model is fuzzy.
The “agentic message passing” framing is also a clue. If agents are going to talk to each other and delegate work, then we’re no longer just wiring an LLM to a database or a calendar. We’re creating a layer of machine-readable authority. That’s much more sensitive than simple tool use. The article says user-specific permissions and authorization will need to be built in more carefully, and that’s the line I trust most. In practice, that’s usually where these systems fall apart.
I’m also a little skeptical of any neat forecast that MCP will become the default in one to three years. Maybe. Or maybe it becomes the default in the same frustrating way that SSH or OAuth became defaults: not because everyone loved them, but because enough vendors implemented them that you couldn’t ignore them. That’s probably the better mental model here.
What I’d actually try today is less “build a fancy agent” and more “treat MCP as infrastructure, then aggressively test the permission boundaries.” If the protocol is going to become the bridge between agents and the rest of your stack, the killer feature won’t be elegance. It’ll be whether you can trust it not to do something stupid when a model gets confident.
Reference: MCPは「AIとツールをつなぐ」だけで止まらない 開発者らが見据えるこれから
