# Simon Willison pushes back on 'MCP was always a bad idea' Hacker News post

> Simon Willison argues MCP still matters for access control, auth, UI, and audit logging, not terminal agents calling APIs directly.

- **Topic**: Models
- **Published**: 2026-09-23T16:27:38.426Z
- **Canonical URL**: https://highsignal.sh/stories/simon-willison-pushes-back-on-mcp-was-always-a-bad-idea-hacker-news-post-6fd955f7

## Why It Matters

Willison's post defends the Model Context Protocol as infrastructure for constrained, auditable agent access rather than assuming full-agent terminals make it obsolete.

## Key Findings & Analysis

### What happened

Simon Willison published a comment responding to a Hacker News piece titled 'MCP was always a bad idea?', arguing it 'entirely misses the value that MCP brings today.' He concedes terminal agents with unfettered internet access have little need for MCP: 'just let it call APIs directly.'

### What Willison says MCP is for

For setups less autonomous than a full terminal agent, Willison lists four needs MCP addresses: control over which external services the agent can access; authentication that keeps API keys out of the agent's reach; a UI for users to connect and authenticate further services; and strong audit logging. He frames these as the things 'we might want to build' beyond coding agents.

## Original Evidence & Verbatim Citations

> "MCP was always a bad idea?"

— *Grounded field: headline*

> "MCP makes all of that so much easier to provide."

— *Grounded field: summary*

> "Thinking MCP is obsolete because full coding agents don't need it misses out on all of the other things we might want to build."

— *Grounded field: whyItMatters*

> "My comment on MCP was always a bad idea? — Hacker News.This article entirely misses the value that MCP brings today."

— *Grounded field: section:0*

> "just let it call APIs directly"

— *Grounded field: section:0*

> "If you want to operate something that's less YOLO than that, you'll find yourself wanting: Control over exactly which external services it can access A way to handle authentication that doesn't allow the agent to directly access API keys A sensible UI to allow users to connect and authenticate further services Strong audit logging for what's going on"

— *Grounded field: section:1*

> "Thinking MCP is obsolete because full coding agents don't need it misses out on all of the other things we might want to build."

— *Grounded field: section:1*

## Primary Sources & Citations

- [MCP was always a bad idea?](https://simonwillison.net/2026/Sep/20/hn-49779718/) — *Simon Willison* (Reporting)

---

[← Back to front page](https://highsignal.sh/) | [Daily Brief](https://highsignal.sh/brief) | [All stories](https://highsignal.sh/latest)