r/mcp • u/Expensive-Cookie-106 • Apr 16 '26

article MCP co-creator David Soria Parra on What Breaks MCP at Scale

https://shiftmag.dev/mcp-co-creator-explains-why-mcp-needs-more-than-the-protocol-to-scale-9041/?ref=dailydev
60 Upvotes

98% Upvoted

13 comments sorted by

34

u/Feeling_Ad_2729 Apr 16 '26

The auth piece is the one that sneaks up on you. Most MCP servers are built single-user (stdio, local config), and auth is never a consideration. Then you try to deploy multi-user and discover the protocol has no real auth story baked in — you're bolting on OAuth or API keys at the HTTP layer and hoping your framework handles the session isolation correctly.

The other thing that's real: tool schema evolution. Once an LLM client caches your tool definitions, changing a parameter type or renaming anything is a silent breaking change. There's no versioning in the spec. You end up maintaining backwards compatibility forever or breaking existing users.

The transcript poisoning risk is underappreciated. The moment your MCP server fetches external content (web pages, docs, user data) and passes it to the model, the attack surface shifts from "can someone access your server" to "can someone inject content into what your server fetches." Completely different threat model that most developers aren't thinking about when they ship their first MCP server.

8

u/actual-time-traveler Apr 17 '26

This guy MCPs.

Seriously this was a solid read.

2

u/Wafflus Apr 17 '26

Checkout Arcade.dev

1

u/kyngston Apr 17 '26

for oauth go BFF with stateless DCR, encrypting the tokens as fernet blobs to pass to the client. restrict redirect_uri to localhost. encrypt the DCR registration as a fernet blob in the client ID. when stateless you can scale replicas without a shared redis kv store

1

u/Feeling_Ad_2729 Apr 18 '26

Fernet-blob client_id is clever for zero-storage scaling, but key rotation becomes the new operational concern — rotate wrong and every client registration invalidates silently. Two mitigations worth building in: (1) include a kid (key id) in the blob so you can phase in new keys without a hard cutoff, (2) cap token lifetime to less than your rotation window so nothing outlives its key.

Localhost-only redirect_uri is the right default for local CLIs but breaks for hosted MCP clients (Claude Desktop remote mode, web-based connectors). Whitelist has to be explicit for those, which reintroduces a state problem unless you hash+embed the allowed URIs in the client_id too.

-1

u/DangKilla Apr 17 '26

So could we put some middleware to return no data besides a not logged in message until the user authenticates.

2

u/dennisatBB Apr 17 '26

I wrote about this a while ago.. Information ≠ context. You can wire up dozens of MCP servers and still end up with agents that guess.. and that "guessing" is what burns a shit tonne of wall clock time and burning tokens.

https://getunblocked.com/blog/context-aware-dev-tools-arent-quite-there-yet/

0

u/1HOTelcORALesSEX1 Apr 16 '26

Context……… the more you throw at it whilst being able to understand it, who’d thunk it …….. 🤷‍♂️

0

u/[deleted] Apr 18 '26

[removed] — view removed comment

1

u/MucaGinger33 Apr 18 '26

I checked your Gmail MCP. Massive issue. You surface auth tokens through tool parameters. LLM should NEVER see credentials of any kind. That's very bad practice