The MCP debate has a context problem
TNS
OK
Join our community of software engineering leaders and aspirational developers. Always stay in-the-know by getting the most important news and exclusive content delivered fresh to your inbox to learn more about at-scale software development.
EMAIL ADDRESS
REQUIRED
SUBSCRIBE
RESUBSCRIPTION REQUIRED
It seems that you've previously unsubscribed from our newsletter in the past. Click the button below to open the re-subscribe form in a new tab. When you're done, simply close that tab and continue with this form to complete your subscription.
RE-SUBSCRIBE
The New Stack does not sell your information or share it with unaffiliated third parties. By continuing, you agree to our Terms of Use and Privacy Policy.
Welcome and thank you for joining The New Stack community!
Please answer a few simple questions to help us deliver the news and resources you are interested in.
FIRST NAME
REQUIRED
LAST NAME
REQUIRED
COMPANY NAME
REQUIRED
COUNTRY
REQUIRED
ZIPCODE
REQUIRED
Great to meet you!
Tell us a bit about your job so we can cover the topics you find most relevant.
What is your job level?
REQUIRED
Which of these most closely describes your job role?
REQUIRED
How many employees are in the organization you work with?
REQUIRED
What option best describes the type of organization you work for?
REQUIRED
Which of the following best describes your organization's primary industry?
REQUIRED
LINKEDIN PROFILE URL
Welcome!
We’re so glad you’re here. You can expect all the best TNS content to arrive Monday through Friday to keep you on top of the news and at the top of your game.
What’s next?
Check your inbox for a confirmation email where you can adjust your preferences and even join additional groups.
Follow TNS on your favorite social media networks.
Become a TNS follower on LinkedIn.
Check out the latest featured and trending stories while you wait for your first TNS newsletter.
As a JavaScript developer, what non-React tools do you use most often?
✓
Angular
0%
✓
Astro
0%
✓
Svelte
0%
✓
Vue.js
0%
✓
Other
0%
✓
I only use React
0%
✓
I don't use JavaScript
0%
Thanks for your opinion! Subscribe below to get the final results, published exclusively in our TNS Update newsletter:
SUBMIT
2026-07-14 08:00:00
The MCP debate has a context problem
sponsor-gitlab,sponsored-post-contributed,
The MCP debate has a context problem
Skeptics dismiss MCP as too complex, but enterprise AI agents require its structural governance and security controls to scale safely.
Jul 14th, 2026 8:00am by Amanda Rueda
Pawel Czerwinski for Unsplash+
GitLab sponsored this post.
Every few months, a new technology gets its premature obituary. Across many developer circles, MCP’s has already been written. Too much overhead and complexity are to blame. For certain small-scale use cases, the skeptics have a point, but their argument breaks down when you move beyond a solo project into the kind of agentic systems that enterprises are trying to build.
Where the skeptics have a point
When you are the only user and trust is implicit, using an MCP server can add unnecessary complexity. A direct API call is the simpler and often better choice for wiring up a local AI assistant, building a personal automation, or running an isolated script on your own virtual machine. Developers are not wrong in that context.
Where the argument falls apart
Enterprise agentic systems are not single-developer, single-trust-boundary setups. Agents operate across teams, systems, and organizations, often acting on behalf of users who are not even aware an agent is involved. In those environments, direct API calls start creating problems that no allowlist can reliably solve.
“Every few months, a new technology gets its premature obituary. Across many developer circles, MCP’s has already been written.”
Credential delegation is one of the first friction points. Building a platform that runs agents on behalf of enterprise customers quickly leads to questions about agent identity, permission inheritance, and whether it runs as a service account. There is no universal right answer, but the wrong choice carries consequences.
An agent with excessive access creates audit and compliance exposure. While insufficient access causes the agent to fail silently, it erodes platform trust over time. Enterprise buyers in regulated industries raise this concern before the formal security review.
In regulated environments, “the AI did it” is not a sufficient audit entry. Teams need to answer what the agent did, on whose behalf, and under what authority. That information needs to be embedded in the system by design, not reconstructed from logs after an incident. A direct API integration can’t provide this, but a well-implemented MCP setup can. It surfaces the necessary context at the tool-call level, capturing which server, credentials, and scope authorized each action.
An allowlist isn’t governance
When someone asks whether an agent can access things it should not, the instinct is to reach for an allowlist. Define the permitted tools, check against it before executing, complete the task, and move on. This approach feels like governance because it resembles a policy. A policy, however, is only as strong as the system enforcing it. In practice, allowlists break down through misconfiguration, unexpected agent behavior, and edge cases nobody anticipated when the list was originally written.
“In regulated environments, “the AI did it” is not a sufficient audit entry.”
The more durable option is the structural least privilege. When an agent’s MCP connection only exposes the tools required for its specific task, the agent cannot exceed that scope. For security teams in regulated environments, “it structurally cannot exceed its scope” and “it follows the rules” are meaningfully different assurances.
What still needs work
MCP still creates friction in two areas.
“For security teams in regulated environments, “it structurally cannot exceed its scope” and “it follows the rules” are meaningfully different assurances.”
Capability-scoped server provisioning remains too manual. When proper configuration requires deep infrastructure knowledge, administrators often skip it and fall back on broad connections with an allowlist as a backstop. Until the industry makes provisioning accessible to non-specialists, broader adoption will stall.
The operational layer for managing MCP connections needs to be accessible to security and platform teams, not just the developers who originally built the integration. An administrator should be able to view every active connection in their environment, understand what each one exposes, and identify who is using it, all without reading a config file or tracking down the original implementer.
For organizations deploying agents at scale, these requirements are table stakes.
What enterprise scale actually demands
The conditions that expose a weak governance model announce themselves through incidents. Autonomous agents operating at enterprise scale will find the gaps before you do. If the honest answer is still “we have an allowlist,” the next step is clear. Audit what your agents can access, map it against what they need, and build structural controls before gaps become incidents.
GitLab is the most comprehensive, intelligent DevSecOps platform for software innovation. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation.
Learn More
The latest from GitLab
TRENDING STORIES
Group Created with Sketch.
Amanda Rueda is a staff product manager, AI Execution, at GitLab. Read more from Amanda Rueda