MCP protocol growing fast but auth is already a mess

The new MCP roadmap dropped and the HN thread is cautiously interested but not uncritical. The roadmap introduces progressive tool discovery (servers reveal capabilities as the conversation narrows rather than dumping everything upfront), which commenters note is something they've already had to implement themselves because the current approach doesn't scale. That detail, that practitioners are ahead of the spec, says something about how fast the ecosystem is moving.

The bigger concern in the thread is authorization. MCP's current auth model assumes a human approving access in a browser. That breaks immediately in machine-to-machine or automated agent scenarios, which is exactly the use case everyone is building toward. The roadmap acknowledges this but hasn't solved it yet.

The comparison to the actor model (Akka) came up, suggesting some people see MCP as rediscovering distributed systems patterns that already have decades of theory behind them. That's both reassuring and a warning: reinventing these wheels tends to rediscover the hard problems too.