I guarantee you any LLM will be perfectly capable of navigating HTTP auth [1] which has been around since 1999.
You could use `curl`, or you could bake an HTTP client tool into the agent harness which operates at a more abstract level. The agent would just have a tool that looks a lot like the Fetch API [2] and the harness could simply be configured to inject credentials using the various well-established patterns that have long existed, allow / deny certain methods, etc. The thing is, everything you can do with MCP could also simply be done with REST, so neither is inherently better than the other, I just don't like the proliferation of needless standards.
[1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Aut...
[2]: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/U...
You can’t be seriously proposing HTTP auth (you probably mean basic auth??) as a solution!? Just hand your raw credentials to the LLM, what could go wrong?
Letting the harness inject the credentials implies not exposing them to the LLM.
Besides, the current state of MCP authentication almost always involves just hard coding secrets in .claude/settings.json so it's not like that's doing a great job keeping the creds away from the LLM anyway. All I'm saying is that MCP auth offers no advantage.