| OSI Layer | MCP Kitchen Sink |
|---|---|
| 7 — Application |
All tools, resources, prompts in one bin
● No capability negotiation ● No auth (41% of servers) ● No authorization ● No audit trail The Linux Foundation badgeAn anthropical charitable donation to the Fonndation is the only thing in this column |
| 6 — Presentation | JSON
● No encryption ● No content negotiation ● No schema enforcement beyond "it's an object" Model ingests raw output from server ● No filter between what the server returns and what the model "eats" |
| 5 — Session | MCP-Session-Id removed
in the 2026 stateless redesign
● No checkpointing ● No recovery ● No ordered state Each call is a fresh dump into the pipe |
| 4 — Transport | ● No segmentation ● No reassembly ● No flow control ● No error recovery ● No backpressure Write to stdin, read from stdout If the pipe breaks, the message is gone |
| 3 — Network | ● No routing ● No addressing ● No path selection One-to-one pipe between one client & one server ● No multicast, No anycast If the server is down, the tool is dead |
| 2 — Data Link | JSON-RPC framing
● No MAC ● No checksum ● No flow control ● No error detection beyond "this isn't valid JSON" A corrupted frame is indistinguishable from a malicious one |
| 1 — Physical | STDIO. A pipe. Raw bytes
● No encryption at the transport level ● No integrity ● No authentication The equivalent of an open drain under the kitchen sink |