问HN：MCP是否已经成熟到可以安全使用的程度？
经过一些研究并试图理解MCP，我渴望利用这个理念。然而，我对这种方法的可用性持怀疑态度，主要是因为它仍处于初始阶段。
我（承认有些过于简化）的理解是，MCP的主要目的是为大型语言模型（LLM）提供一种通用语言，以便它们能够处理代理任务，而不必为每个服务、每种语言和每种特定的API风格编写独特的处理程序。这听起来很不错，但我也了解到，MCP服务器的数据源/资源的提供者有责任创建和维护MCP服务器，以便LLM能够利用这些资源。快速浏览互联网可以发现，虽然有很多MCP服务器从集成公司（IC）涌现出来，但其中只有一小部分实际上得到了拥有/运营这些LLM可能想要交互的服务的实体的认可，更不用说直接维护了。
这当然会带来问题。任何对软件开发有更深入理解的人都应该明白，直接从npm、githublab或其他地方拉取库会带来安全和隐私风险（是的，即使它是开源的，恶意代码也可能隐藏在你导入的数百个库中的某一个里）。
我是不是遗漏了什么？目前这一切看起来都像是狂野西部，充满了巨大的炒作，我希望自己能不那么怀疑。如果真如我所说的那样，那么要多久才能让基础稍微稳固一些，以便我们真正拥有一个可靠、成熟的MCP供我们使用呢？
查看原文
After doing a bit of research and trying to get my head around MCP, I am eager to take advantage of the idea. However, I am skeptical of how usable the approach is as of yet, mainly due to its nascent nature.<p>My (admittedly oversimplified) understanding is that MCP's purpose is mainly to provide a sort of langua franca for LLM's to tackle agentic tasks without having to write unicorn handlers for every single service in every single language in every single individual API flavor. That sounds great, but my understanding is also that it is incumbent on the provider of that MCP server's datasource/resource to create and maintain the MCP server so that LLM's can take advantage of them. A quick look across the interwebs shows that while there are a TON of MCP severs popping up from IC's, a fraction of them are actually endorsed, much less directly maintained, by the entities that own/run the services an LLM might want to interact with.<p>This of course presents an issue. Anyone with a greater understanding of software development beyond a junior level should understand that pulling libraries straight out of npm/githublab/whathaveyou carries with it security and privacy risks (yes, even if it's open source, nasty bits can be hidden in one of those 100's of libraries you are shotgunning into your app).<p>Am I missing something here? It all seems very wild west at the moment with a tremendous amount of hype, and I'd like to not be so skeptical. If it is as I say, how long until the foundation solidifies a bit and we truly do have a solid, mature MCP set to draw from?