Notifications
Clear all
Topic starter
19/08/2026 3:44 pm
TL;DR: CLI can be token-efficient for local, single-user agent workflows, but Stacklok argues that the real deciding factor is credential exposure and multi-user governance. In enterprise settings, MCP changes the security model by keeping downstream credentials server-side instead of placing them in the agent execution environment.
NHIMG editorial — based on content published by Stacklok: Comparisons MCP vs CLI Tools: Why Security Changes the Answer
By the numbers:
- A Scalekit benchmark found CLI costs approximately $3.20 per 10,000 operations for GitHub tasks, versus $55.20 for MCP, a 17x difference.
- Five MCP servers with 20 tools each can inject approximately 80,000 tokens of schema before any task begins.
Questions worth separating out
Q: What breaks when an AI agent uses CLI tools in a multi-user enterprise workflow?
A: The credential model breaks first.
Q: Why do MCP-based agent workflows matter for NHI governance?
A: MCP keeps downstream credentials server-side instead of placing them in the agent’s execution environment.
Q: What do security teams get wrong about agent tool access?
A: They often treat tool connectivity as a simple integration problem.
Practitioner guidance
- Map the credential boundary for every agent workflow Document where each credential lives, whether it is inherited from a user session, stored in a local host, or held server-side behind MCP.
- Separate single-user automation from shared-access automation Allow CLI-backed workflows only where the agent is acting as one named user and the blast radius is intentionally bounded.
- Require auditability at the tool layer Verify that every sensitive tool invocation can be tied to the human or service identity that authorised it, including the parameters used and the downstream system reached.
What's in the full article
Stacklok's full article covers the operational detail this post intentionally leaves for the source:
- A deeper side-by-side breakdown of CLI, Skills, and MCP deployment patterns for developer and enterprise workflows
- Examples of how per-user OAuth and server-side credential storage change audit and revocation handling
- A more detailed decision matrix for choosing between CLI, MCP, and hybrid patterns in production
- Specific token-cost comparisons and benchmark context for schema loading and tool discovery
👉 Read Stacklok's comparison of MCP, Skills, and CLI for AI agent workflows →
MCP vs CLI for agents: where the credential boundary breaks?
Explore further
19/08/2026 4:22 pm
Credential location, not token count, is the real architectural control point. The Stacklok comparison is useful because it shows why performance debates often hide governance risk. CLI can be cheaper in tokens, but the credential surface moves into the agent execution environment, which changes the access model rather than merely optimising it.
A few things that frame the scale:
- With 70% of organisations already granting AI systems more access than human employees, the governance gap is structural, not hypothetical, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented policies to govern AI agents, according to AI Agents: The New Attack Surface report.
A question worth separating out:
Q: How should organisations decide between CLI and MCP for agent automation?
A: Use CLI when the agent is acting as a single developer and the credentials are intentionally that person’s own. Use MCP when the workflow is shared, customer-facing, or production-bound, because the ability to scope, log, and revoke access becomes more important than raw token efficiency.
👉 Read our full editorial: MCP vs CLI for agents: why security changes the answer
