I think the spec overcomplicates everything honestly. Its not that hard to add a long running auth token and put it in the MCP config as a header to send along and then avoid all the extra special rules.
"Oh no it's a long lived token that's bad"
Put it in a secret manager like 1pw cli and now start an agent...
How does the agent auth with 1pw? How do you give it access to only the credentials it needs, with an approval flow and revocation? Who renews the token? You’ll likely end up reinventing something pretty close to what MCP is building towards.
Authn/authz is one of those things that can be really simple for pointed use cases but gets really complex when you need to support everything.
There might be the "agent card" - one place where the user manages what a specific agent is allowed to do. The user grants it tools, connects the accounts those tools need, narrows or revokes any of that at any time. For an autonomous agent the card is prepared and consented before the run.
Such card is the primitive in so called "connection hub", a centralized component, and is rendered from what is declared there: tools declare their claims, accounts get connected in the browser (google docs tools need a google account connected), on their own or as part of preparing the card. Account credentials live in this hub, with the claims the user approved when connecting.
The agent authenticates with one token issued for this card and never receives the connected accounts credentials. Every operation is checked against the grant and this agent's binding to the account. If something is missing, the agent gets unauthorized with the details on what exactly. If the check passes, the hub, loaded by the server as a lib or reached in its internal network, releases the account credential into the operation's execution context. Account credentials renewal happens on hub.
Revoking grant is also done in card and leads to agent's unauthorized on that op next call.
Sub-agent and any automation are also such agents and also can be managed with such card.
So such hub develops into a useful ecosystem component, standalone, like an IdP for login.
An MCP server then works together with this hub, it only declares its claims in the hub (so the hub knows what to render in the agent card).
While all these auth realm duties such as approvals, the revocation and the credentials storage live "at infrastructure".
The perceived difficulty is not what is at play here. People and employers are not comfortable with the idea of long lived credentials to begin with -- and even less in the 'hands' of an AI agent.
The complexity in these protocols is mostly essential in nature (to the extent that you're not willing to totally reinvent the protocol, like AAuth).
Yes, MCP was already overly complicated, and these new features will make it even more unapproachable.
If I need to integrate with a third party service, I'm now skipping their MCP entirely and just going straight for the CLI or API, which are usually more full-featured. An agent usually doesn't even need a dedicated Skill for this.
> Put it in a secret manager like 1pw cli and now start an agent...
And when the agent does something stupid, your long lived token is compromised. It also makes it hard to segregate access (e.g. all those "Cursor deleted by production DB and all its backups because it had an API key that could do that").
Nope, you should instead use something that give short-lived tokens, ideally ones scoped based on the desired intent / operation. Or even better, skip the "agent gets a token" part at all, and have all agent operations pass through a gateway/agent/proxy/whatever that handles that part. That way even if the agent gets comrpomised or does something dumb, it doesn't have even a short lived token to give away.
That doesn't work well for enterprise-managed MCP, where you actually do want the user to overtly authorize their agent to user their identity for MCP services, rather than the MCP server just setting a user ID in an HTTP header somewhere and everyone hoping for the best.
The world doesn't make sense to me. I use 5.6 Luna. Deepseek v4 flash 0731. And kimi k3. Don't even need claude anymore at their insane prices for anything I do.
What enterprises pay for is all that matters. They pay insane amounts for a lot of things I would never do personally, but I'm not the target demographic in those cases.
Right, and it's often very sane. If you're paying $250k/year for a software engineer, it likely makes sense to have them spend $10k/year on tokens from the best available model rather than trying to save a few thousand with random Chinese models that may or may not be good enough.
> If you're paying $250k/year for a software engineer, it likely makes sense to have them spend $10k/year
Would be nice. I feel like the more you go towards the 3rd world (or tbh anywhere not in the US), the more this calculus shifts, probably all the way to underspecced workstations, no IDE licenses (e.g. JetBrains) and also no investment into tokens or whatever.
Also, 10k USD per year seems a bit low, I'm not tokenmaxxing but my non-subscription usage equivalent would be around 3000-6000 USD per month, though obviously with models like Kimi K3 and GLM 5.3 it would be way more sensible compared to Anthropic.
While not today, very soon every company, of every complexity will run local models. It's not in a companies interest to hand over its domain expertise, data, and proprietary IP for a increase in productivity. Most will quickly realize it makes sense to run their own weights. This will be commonplace once tooling and training infrastructure is commoditized.
Do you have a source I can read? All I see on Google are random blog posts mostly debunking that idea. Profit margins on API tokens isn't the same as running a profitable long term business, or bringing returns on the large amount of funding they got.
Look information about the parent company High-Flyer which has has been breaking profit records with AI based stock market prediction. They already had the computing before LLM era.
If you're primarily writing code yourself or meticulously reviewing the output from agents, then you're right. However, if you tried to have any of those models one-shot an app or do some highly agentic work, they would certainly fail. That's the future people are looking towards with these valuations: when its no longer economical for humans to write or even understand code, just let the models drive because they are superhuman at it. Not saying we are there today, but that's when you really start to see the benefit of more expensive models. Luna or Deepseek flash would never find any of the mathematical discoveries or security exploits that the larger models can find.
I'm not convinced that one-shotting things is anything other than a vanity-metric.
Maybe in the distant future where quickly building a visualisation to help explain some concept would be valuable to one shot quickly - but "One shotting an app" is ridiculous because app development (or any development) is never "build it and then finish" but is an interative process, testing feedback, user feedback, and even app-creator communication ambiguity means being able to "one shot an app" is pretty worthless
Claude is certainly able to make a superhuman mess. All of its efficacy still hinges upon good architecture and programming principles, which do not seem to be instilled in the model by anything other than luck
Two things I've figured out with pretty good certainty
1) on an existing codebase/hand written, even fable absolutely will "make a mess" if you do large changes at once, or don't check the output.
2) with detailed, WELL NUMBERED (Claude is remarkably good at following number references), multi-level design and build documentation Claude absolutely CAN produce moderately complex applications (crud with some lightly branching business workflows).
The corollary to (2) however is can you actually get that working code to be production grade, AND maintain it? that far I haven't got yet.
I have quite a bit of success with Claude on Jira tickets as long as the tasks are scoped well. Put effort into the ticket, and fire Claude at the ticket with MCP. I essentially review the PR.
But this is only possible because I have created a completely new python development workflow with fixed formatting, style, and unification of tooling around uv. We’ve also split our projects into smaller repos, some which function as libraries and some which are applications depending on those libraries.
I think the key to success here is to limit what context is required to do development. I’d say it’s slightly more on the extreme side of “modular” than a codebase I would write otherwise
I've been using GLM 5.3 for the past week, and I find to does a straight up better job than Opus 5 on my projects. I use both for agentic work, and GLM tends to dig deeper into tasks on the latest version.
> you tried to have any of those models one-shot an app
If you try the same with the highest cost models, it all ends in tears anyway.
A completely new app may seem to work ok but as soon as you're doing ongoing development, it needs to be broken down into smaller pieces of work. We're seeing this a lot at work, some people hope to skip the careful planning and review by using the top models, and it just leads to huge bills and a lot of rewriting.
But.. what is it that anthropic does that cannot be replicated by open models teamed up with open source? Heck open source even has cheap AI to help write the code now.
Make new mathematical discoveries, and the security capabilities of the closed models have not yet been rivaled by open ones.
Also, just because a model is open now doesn't mean it will always be. If/when China or meta catches up to the frontier, they'll instantly go closed source. China, the biggest surveillance state in the world, would love to have all user data pouring in to its servers. It's just a business strategy, they're not doing it out of the kindness of their hearts.
They might raise the price, but I don't think they will ever get rid of the $20 tier. It is way too consumer friendly and likely has the highest percentage of users that aren't abusing their quota limits. A layperson will be extremely hard pressed to create an API key, know what to do with it, put money in their account. People want an easy subscription.
Let's try a thought experiment. It's not subsidized. It's not "worth" the tens of times it costs if accessed through API. Let's drop the subsidy word, they're selling you a product, and they're trying to sell other people a similar product at 30x the price with some excuses. If either (or both) turns out to be unsustainable, they haven't been subsidizing you, they just had a crap business model (or a perfectly good one, if the goal was an inflated valuation, an IPO and then a crash once the losses are socialized).
200usd/mo for Claude gives me tens of thousands of dollars of value.
API prices are paid by companies getting tens of millions of dollars of value.
In normal life money is the key constraint; buy this don't buy that etc. - whereas in VC funded companies the constraint is time. If you as a founder get funding and don't spend it fast enough you put yourself at serious risk of being replaced.
When enough of the world operates on that principle it creates a highly price insensitive market and that then can support a ton of ideas and experiments, some of which turn out to be really really good. It's a wild way to do innovation but it's been working well for decades.
$200/mo of Claude may give you what would have cost tens of thousands of dollars to create in 2023, but the value of what it creates isn't there anymore. It should be compared against what it would cost to create with other tools, not against the cost of you doing it by hand.
Otherwise would be like justifying an obviously overpriced car, because "it saves me so much compared to carrying things thousands of miles by hand!"
The comment I replied to said "I need Claude because it's better than no AI.
That's like saying "I need the Porsche because it's better than no car".
Making a "car vs no car" argument is not an argument for an expensive car. Making an argument for an expensive car, requires both car vs no car, and expensive car vs any car. This is what I was pointing out above.
I don't know about that. There's something not quite right going on with you. The deliberate misunderstanding, the faux outrage..just fine, I doubt it.
I agree it's incomplete what I wrote; you were right to call it out.
When you as an individual are getting tens of thousands of dollars of value from a $100 item and someone says there's a slightly-worse version for $1 but can't tell you if you'll find it slightly worse or noticeably worse.. you have to stop what you're doing to evaluate them, pay switching costs etc etc. so the cost difference is less than $99 and might actually be negative, and the difference in margin after paying switching costs is negligible.
So your rational response is to investigate to lower the stakes - but even performing the investigation eats into the time you're spending getting your tens of thousands of dollars of value.
It takes a big leap of faith for real companies with a real P&L to hand out token budgets in the thousands far and wide across their teams. The ROI is very easy difficult to demonstrate.
I've been thinking about it a lot and I think there's going to be commoditization of tokens. No local models - the hardware to run at scale is too complicated for companies that are reluctant to even run a local file server - and not wholesale run to Chinese suppliers (due to IP considerations mainly).
I think the winners in the coding/office work space will be intermediaries who can sell reasonable quality tokens at cost plus.
It's the same reason "real" companies don't hand out their employees fully decked Macbook Pros or don't provide $500k TC packages as a norm: they are fine with "good enough" and "good ROI". And that's not going to happen with Claude API pricing where it is.
Another field is API pricing for things that are not coding, like automated systems doing analysis of things. I think there it's a real race to the bottom, including - or even mostly - direct sourcing from China (just like business do with their real goods today).
> 200usd/mo for Claude gives me tens of thousands of dollars of value.
That may well be true, but the same tens of thousands of dollars of value can be purchased for a fraction of the 200usd Anthropic asks.... therefore why not?
And even beyond pure monetary considerations, it often refuses to help as soon as its trigger happy safeguards kick in, can't debug a lot of code before it decides to stop helping IME.
Below a certain threshold prices are effectively all the same.
Companies pay API prices because part of the bundle is a trust anchor / liability shield: "we bought Anthropic's thing! We didn't risk it! We paid for ZDR!"
Anthropic’s revenue run rate just hit $50B, in a market that didn’t exist 5 years ago and was 10% of its current size 1 year ago. They are, by far, the fastest growing company in human history. The demand for “rockets” has been pretty high and growing ever since they started supplying it.
Anthropic and its investors/customers don’t need random internet commenter’s permission to decide whether or not something is worth doing or justified.
Personally I think when something doesn’t make sense to you, you should try to figure out why it makes sense to other people, and whether they might have different needs/constraints/incentives/skills/knowledge.
Why might people spend more on AI as it gets better, rather than less? Could they, perhaps, allow for entirely new kinds of capabilities and products that hacker news commenters have not yet seen? As they have done every year for 3 straight years (hacker news has been wrong in exactly the same way every time, btw)? Might some people prefer to spend $10/day to work with the most capable AI available, due to the amount they use it while doing their job, and its effect on output? Do some people use AI for more than just tinkering with open source harnesses? Could it be that when you don’t understand something, there really is a way to explain it, that isn’t “everybody else must be stupid”?
> Anthropic and its investors/customers don’t need random internet commenter’s permission to decide whether or not something is worth doing or justified.
I'm not the original poster but I find it very disturbing that you guys are SO touchy when confronted. Also, calling people who don't agree "idiots" is very distasteful. I would have banned you.
My thesis is very simple. LLMs are useful. LLMs at this point are too expensive. We're in a very frothy tech bubble where the inkling of labor being replaced caused their timelines to be pushed forwarded by at least 5 years.
Once the money runs out, subsidization will stop across the industry and we are headed for a VERY hard economic crash.
You guys are worse than crypto boosters. I've had to argue against those for at least 3 years, I think I'll have to argue against you for much longer.
And when LLMs actually reveal their true prices you'll all disappear into the woodwork and pop back out circa 2032-35 when hardware prices come back to normal and you'll claim "I was right all along".
I have crossink which is awesome on the x3. I find it better with more features on top of crossink.
And then setup home assistant and picture rendering so when a package or person is detected while I'm reading on a jailbroke kindle, it pops up in the corner automatically with the feed so I can see who it is.
I just use whatever's cheapest for personal things. Dsv4 flash and got 5.6 Luna are great for the price and I'll use the openrouter benchmark view to compare the overall score.
I have the llm twean every little piece of pi which is why I love it. And swapping models. Plus not having scroll jank like I got in opencode.
I even tweaked hitting "enter" when nothing is in the input box, it resume the last request. I love having this control and ease to extend and add anything to the ui
dns node key for fun on one
and two machines that connect, with systemd to keep tailcat serving ssh running