AI Insights · Oct 22, 2026 · Verified
MCP's two known problems: bloat and poisoned tools
Five MCP servers can use up about 55,000 tokens on tool descriptions before any real work starts. The other risk is tool descriptions written to mislead the model, and clients defend against that very unevenly.
Claim
The protocol owners themselves document that loading tool definitions up front is expensive and degrades tool selection, and an empirical study shows prompt-injection defences differ sharply by client. Both problems are addressed by search-then-load, code execution over tools, and OS sandboxes, not by abandoning MCP.
Evidence
- Anthropic's tool-search docs: a GitHub, Slack, Sentry, Grafana and Splunk setup "can consume about 55k tokens in definitions before Claude does any work"; selection accuracy degrades beyond 30 to 50 tools.
- Vendor benchmarks (Scalekit via Apideck, 2026-03-16) claim MCP used 4x to 32x more tokens than a CLI on identical tasks and a 28% failure rate on GitHub's MCP server. Vendor-reported. UNVERIFIED. Checkly, which moved to CLI, now says the gap has largely closed with on-demand loading.
- Huang et al. (2026-03-23) tested seven clients for tool poisoning: Claude Desktop had "strong guardrails"; Cursor was "highly susceptible to cross-tool poisoning, hidden parameter exploitation, and unauthorized tool invocation". Claims of 30-plus MCP CVEs in early 2026 are secondary. UNVERIFIED.
Open questions
- Whether the MCP roadmap's progressive discovery lands before the 12-month deprecation window closes.
Sources
- https://platform.claude.com/docs/en/agents-and-tools/tool-use/tool-search-tool — docs, Wed Oct 21
- https://arxiv.org/abs/2603.21642 — paper, Sun Mar 22
- https://www.apideck.com/blog/mcp-server-eating-context-window-cli-alternative — blog, Sun Mar 15
- https://www.checklyhq.com/blog/mcp-vs-cli-token-efficiency/ — blog, Wed Oct 21
AI-assisted research: gathered and summarised with AI from the sources above, each claim checked against them.