Topic starter
19/08/2026 3:44 pm
TL;DR: CLI can be token-efficient for local, single-user agent workflows, but Stacklok argues that the real deciding factor is credential exposure and multi-user governance. In enterprise settings, MCP changes the security model by keeping downstream credentials server-side instead of placing them in the agent execution environment.
Editorial analysis by NHI Mgmt Group, based on content published by Stacklok: “MCP vs CLI Tools: Why Security Changes the Answer”.
By the numbers:
- CLI tools consume fewer tokens than unfiltered MCP server use, with benchmarks showing roughly $3.20 per 10,000 operations for GitHub tasks versus $55.20 for MCP.
- Five MCP servers with 20 tools each injects approximately 80,000 tokens of schema before any task begins.
- GitHub’s MCP server with 43 tools injects 17,600 tokens of schema before the agent begins.
Key questions
Q: What breaks when an AI agent uses CLI tools in a multi-user enterprise workflow?
A: The credential model breaks first.
Q: Why do MCP architectures reduce credential exposure risk for agents?
A: MCP moves downstream authentication to the server side, so the agent calls a typed tool interface instead of holding the target system’s secret.
Q: How should organisations decide between CLI and MCP for agent automation?
A: Use CLI when the agent is acting as a single developer and the credentials are intentionally that person’s own.
Practitioner guidance
- Define the agent's identity boundary Document whether the agent acts as one user, one team, or many users, and map that answer to the credential model before choosing CLI or MCP.
- Keep downstream credentials server-side Route access to remote systems through MCP-style server-side credentials when the agent must touch shared services, regulated data, or customer-owned environments.
- Separate procedure from access Use Skills for workflow guidance, but do not treat them as an access control layer or a substitute for tool authorisation.
Bottom line: CLI can be acceptable for a single developer’s own workflow, but it becomes a governance problem once the same agent serves multiple identities.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:22 pm
Credential placement, not tool syntax, is the real security control in agent workflows. The article shows that the same agent can be acceptable or unacceptable depending on whether downstream credentials sit in the host environment or on the MCP server. That means the control boundary is architectural, not cosmetic. For identity teams, the decisive question is whether tool access is inheriting a human session or being governed as a separate service boundary.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between agent skills and MCP?
A: Agent skills provide the procedure, meaning how an agent should do a task. MCP provides the connection to tools and data, meaning what the agent can reach. They work together, but they solve different problems. Skills govern behaviour, while MCP governs access to external capabilities and should be controlled separately.
👉 Read our full editorial: MCP vs CLI for agents: why security changes the answer