Wrong, you're assuming the "bespoke glue code" does not exist with MCP, it's because LLM does that for you, but it's still dealing with your logic. Actually, debugging why the LLM's requests are failing requires more work and needs to expose more details on how to handle the error. Typically requires checking the LLM's understanding of the tool definition (you're debugging the LLM's understanding, which differs across models). But also, remember about costs. Everyone will put an LLM in front of REST, with a cost per token, when a simple form could do the same? It's about unit economies, not interoperability.

Nope! MCP is not ripe yet, changed transport from SSE to streamable HTTP in less than a year, and is just for LLM usage. This "protocol" is a subset of specific endpoints(OAuth, response schema, etc) and session persistence. Nothing you can't do with function-calling/structured output. Your question goes in another layer... Will users move to using LLMs as the primary way to interact with backend services? Actually, you're still designing REST for MCP... Integrations between systems will be deterministic, without MCP in the process, pure REST...

Depends on your users/market needs, but as bullet points: Prefers headless architecture (trust me, give you a favor for the future) JWT (yep), but PASETO is an option if you want to have a confidential payload encrypted. Remember to create access and refresh tokens with short TTLs. Never store the JWT or similar in the db. First, verify the signature/expiration; then, if needed, compare it with the jti (ID) in your table/collection to extract user data (or the token payload) Never set confidential info (email, name, etc) in the JWT payload, but userId, orgId, etc. is fine Caution with the algorithm, sign the JWT with an explicit option In frontend, prefer cookies httpOnly, but localStorage 🤷🏻‍♂️ : XSS, supply chain attack or 3rd party scripts Handle access token expiration with 401, set interceptors in the frontend to fetch /renew and get a new token In authentication, implement captcha. Otherwise, protect it against brute-force attacks with an incremental delay that ends with a temporal block per IP. Wildcard suggestion: Put Cloudflare in front of your app and configure WAF rules.