You’ve felt the anxiety. You hand your AI agent a shiny new API key, cross your fingers, and pray it doesn’t leak it into a prompt or pass it to a malicious endpoint. We are so desperate for seamless AI-to-API integrations that we’re willing to hand over the keys to the kingdom just to avoid writing a little glue code.
Enter the Model Context Protocol (MCP). The industry has hailed it as the holy grail of agentic systems—a standardized way for LLMs to interact with any service. But peel back the layers, and you’ll realize it’s a bloated, insecure nightmare. It forces our expensive, unpredictable models to navigate raw APIs, guess parameters, and burn through tokens like there’s no tomorrow.
We are so obsessed with making AI act like a human that we forgot how to make it act like a competent sysadmin.
The fundamental flaw of MCP is that it treats the LLM as an API consumer. But LLMs are terrible at guessing API parameters. They burn tokens faffing around trying to figure out the right payload, bloating their own context windows until they eventually hallucinate a syntax error. Worse, to make these raw API calls work, you have to expose your credentials to the model itself.
Handing an LLM a raw API key and hoping for the best isn’t an architecture; it’s a zero-day waiting to happen.
The absurdity of this industry push was perfectly captured when a Vercel engineer recently suggested that harnesses should abuse standard HTTP headers—sending Accept-Language: rust—just to tell the server what language the client prefers, because they were too lazy to ask for proper standardization. This is the kind of architectural bankruptcy that happens when you try to force LLMs into the messy, unstandardized world of raw web APIs.
So, what’s the alternative? We need to regress. We need to abandon the quest for a grand, unified AI-to-API protocol and go back to the oldest, most reliable tool in our arsenal: the command line.
Instead of giving the model an API key and letting it guess endpoints, build a simple CLI wrapper. The wrapper holds the credentials securely. The LLM never sees the secrets. It just runs a command. The wrapper captures the output, smartly truncates it, and feeds only the essential data back into the LLM’s context window.
The future of AI agents isn’t a sprawling web of interconnected APIs; it’s a highly constrained, heavily monitored bash shell.
This approach solves both of MCP’s fatal flaws. First, it solves the security risk. The credentials are abstracted away behind the CLI. The model acts as a shell user, not an API consumer. Second, it solves token bloat. A well-designed CLI wrapper can capture massive outputs locally, truncate them, and allow the LLM to query or expand specific sections later—just like Node’s util.inspect.
We don’t need another bloated standard that tries to make AI seamlessly talk to every microservice on the internet. We need strict boundaries. We need sandboxed environments. We need to treat our LLMs like highly capable but untrusted users operating in a tightly controlled terminal. Stop building MCP integrations. Start building CLI wrappers.
FAQ
Q: What about agents without shell access?
A: If your agent doesn't have shell access, it shouldn't be interacting with external systems in the first place. Sandboxed environments and strict CLI wrappers provide the exact same functionality without exposing raw credentials to the model's context window.
Q: How does a CLI wrapper actually save tokens?
A: CLI wrappers capture, truncate, and store output locally, allowing the LLM to query only the specific parts it needs. Instead of dumping a massive JSON response into the context window, the agent asks the wrapper for a summary, drastically cutting token bloat and cost.
Q: Is MCP completely useless?
A: For 95% of agentic use cases, yes. It's an over-engineered solution to a problem that doesn't exist. We don't need a new protocol for AI to talk to APIs; we need better command-line tools that constrain the AI's reach and protect our secrets.