maharshi365

Author here — this is the follow-up to my "Why MCP was always a bad idea" post (https://maharship.com/blog/why-mcp-was-always-a-bad-idea), im dying on this hill

A few more rules that I added personally, and a few standard rules. Its more of a centralization of cool rules that are more llm friendly. - tailwind cannonical class rule - duplicate types and consts (take zod/drizzle schema inference into account)

Also not a fan of installing skills for something that should be a package. Didn't like how dmmulroy had that as the install method. This just makes it super convenient.

I occasionally add more rules as I see more common ai slop

I think oxlint ships unicorn as a plugin to enable --> check into that

But if any others, let me know, and feel free to make a pr!

Awesome. Feel free to make a pr for any rules that you think are important. I've started adding to my friends sloppy codebases and its great!

i think standards are good for low level things. APIs change, model behvaiors change, we basically are allowing an external service provider to control our agent prompts.

1. Control can be done via CLIs --> api key based access controls. We have been doing it forever. 2. I think this really only applies to Oauth based MCPs. Many server support api key based auth, stored as files --> security is still flawed imo. 3. This can be done via apis/clis too --> not something unique to MCP iimo 4. Same thing, not unique to MCP --> api servers can also be logged

MCP doesn't inherently make this easier. its still requires engineering maintaincence.

Were in a world where agents are more autonomous. Need stuff to be easier for agents and not humans

Yeah I think a better header is good. The idea isnt bad in concept.

In my experience they are very good at figuring out the apis. Well designed clis matter here but I've been able to give llms clis and its been pretty good.

I've been thinking about this. Technically mcp auth is also not secure, the keys are in env or in file and accessible to the agent.

I think something like infiscial ai proxy could be useful here. Never store the creds on device.