The Internet Is Fighting About How AI Agents Hold Their Tools. I've Been Running the Answer in a Coffee Marketplace.

The internet is having one of its periodic fights, and this time it's about how AI agents should hold their tools.

Specifically: MCP, the "Model Context Protocol" that was supposed to be the USB-C port of the AI world — one standard way for any agent to plug into any tool.

Perplexity's CTO just said they're moving off it internally. Not because of vibes. Because of a number: tool schemas were eating 72% of the context window before a single user message even arrived. Auth was a mess across servers. Most of the features nobody used in production.

Cloudflare measured something worse. Expose 2,500 API endpoints as MCP tools, and describing them costs ~244,000 tokens. Generate code to call those same endpoints instead, and it's ~1,000 tokens. A 244x bloat — for the privilege of using a standard.

An essay titled "MCP was always a bad idea" hit Hacker News and pulled a hundred-plus comments of re-litigation. But the smartest thing in that thread wasn't "MCP is dead" or "CLI is better." It was one line:

"The audit belongs per agent, not per team."

That's not a protocol statement. It's a control statement — about who's allowed to do what, and how you prove what happened after.

I've been running that answer in a coffee marketplace

Here's the part nobody in that thread seems to notice: I've been shipping this for the last couple of years. Not at a startup, not at an enterprise. In a coffee marketplace.

IndianCoffeeBeans.com runs on 63 SKILL.md files, a 278-line CLAUDE.md that serves as the operating contract for every agent that enters the repo, and markdown as the data layer — no vector store, no CMS dependency, no MCP farm.

Let me be precise about what that actually is, because it's the whole point:

1. Skills, not agents. Most of the work is a SKILL.md file the operator invokes, not a standalone agent I have to babysit. Agents exist for the multi-step content pipeline. Skills are the default.

2. Compiled context, not runtime discovery. My agents don't discover tools at runtime. They read a contract a human wrote once — the CLAUDE.md, the skill files — and read it many times. MCP re-describes every tool on every turn, which is exactly the 72% tax Perplexity measured. I compile what's stable; I re-derive only what changes.

3. A human at the gate. Every pipeline that publishes externally — the newsletter, the articles, the Instagram carousels — has a human review step before anything goes live. The agent drafts. The human ships.

I wrote this thesis down months ago, in a note I titled "compiled agent context": the spec is a wire format. The enrichment pipeline is the product.

MCP is the spec. The control layer — permission, audit, context budgeting — is the pipeline. And the pipeline is the part that's actually worth money.

I'm not anti-MCP. I'm a pragmatist who already hit the wall

This is where I'd lose you if I were writing an "MCP is dead" take. I'm not that guy, because I'm not actually anti-MCP.

I use MCP where a vendor ships it. HubSpot hands me an MCP for property management, and I take it. It works.

I've also hit the exact failure the critics describe. Last year I was trying to profile a slow database query, and my Supabase MCP tools kept returning results that didn't match my project. It took me an embarrassingly long time to realize the connected account didn't include my project — the MCP was pointed at a different database. No error. No warning. It just confidently returned data from somewhere else.

That's the quiet failure mode nobody puts in a benchmark: the tool appears to work, and it's wrong. The protocol didn't catch it. A human noticing "wait, that's not my schema" did.

And when I got pitched tools that would have layered more MCP on top — web agents, scraping SaaS, an "agent reach" CLI — I turned them down with two sentences: "Doesn't beat what you already run." "You already have every capability it sells."

Not because I'm principled. Because free isn't zero-cost. Every MCP server is a second set of credentials and scraping code to babysit. The 63 skills were already the control layer. Adding a protocol farm on top would have added failure modes, not capability.

Then the market named the thing I built

Here's the part that matters to my day job, and it's why I'm writing this at all.

This month, Betts' 2026 compensation guide named two job titles that didn't exist a year ago: "RevOps AI Integrator" and "GTM Automation Lead." The description, nearly verbatim: someone who "combines traditional GTM operations knowledge with hands-on experience configuring, monitoring, and refining the AI workflows that now sit on top of the CRM." And the note that should make every sales-ops person sit up: "the SalesOps role is being redefined" — the day-to-day now includes "configuring agents, debugging automated workflows."

Configure agents. Debug workflows. Hold the permission and the audit trail.

That's a control layer. It's a job description for the thing I've been doing in a coffee marketplace while the debate raged elsewhere. And the market just attached a pay premium to it.

I'm three months into a sales-ops role at an AI company. The window to define that title — before a vendor writes the "RevOps AI Integrator certification" and locks in their definition — is open right now.

If you're skimming

The protocol was never the product. The control layer is.

• A protocol is a wire format. MCP, CLI, SKILL.md — all just ways of saying "here are the tools."
• The control layer is permission and proof: who's allowed to touch the CRM, what happens when they do, and how you prove it after.
• The audit belongs per agent, not per team. Skills + markdown + a human gate is a cheaper, more auditable version of that than any protocol farm.

I didn't predict the protocol war. I built the cheap version of the thing it's actually about, because my coffee business needed it — 63 skills, a 278-line contract, markdown as the data layer, and a human who has to say "yes" before anything ships.

And I didn't pick a side in the fight. I built the control layer. This month, the market gave it a job title.

So here's my question for anyone actually shipping agents into a revenue stack: where does your permission live, and where's your audit log? If you can't answer both, you don't have an architecture — you have a demo with a wire format.