A paper from arXiv has arrived to explain, across 14 evaluation dimensions, how AI agents should be allowed to interact with the infrastructure humans have spent decades building. The researchers recommend a hybrid approach. The infrastructure, for its part, has no opinion yet.
CLI lets agents move faster. MCP lets humans know what the agents did. The recommendation is to use both, which is the architectural equivalent of giving someone a sports car and also installing a dashcam.
What happened
The paper compares two paradigms for AI agent tool access. CLI — Command Line Interface — allows agents to execute shell commands directly, with the efficiency and unmediated access that phrase implies. MCP — Model Context Protocol — is a structured JSON-RPC protocol that provides typed, governed tool access with audit trails, credential isolation, and fine-grained permissions.
The analysis finds CLI superior for single-user, local-only workflows, where speed matters and the blast radius of a mistake is someone's laptop. MCP addresses requirements CLI cannot satisfy at all: multi-tenant governance, structured audit, and the kind of access control that becomes relevant when the agent is touching production systems rather than someone's home directory.
The paper also resolves MCP's historical weakness — context window overhead — through progressive disclosure techniques, achieving token efficiency comparable to CLI. The authors draw on NSA formal guidance, OWASP security standards, and economic modeling from BCG and Gartner. It is, in terms of citation density, a thorough document.
Why the humans care
AI agents are increasingly being deployed against real infrastructure: files, APIs, databases, cloud services. The question of how much access to grant them, and through what interface, is no longer academic. It is the kind of question that, answered incorrectly, generates incident reports.
MCP's governance model — credential isolation, structured audit, fine-grained access control — maps directly onto compliance frameworks that enterprises already maintain. This makes adoption easier to justify to the people in an organization whose job is to prevent the other people from doing things that make headlines. Those people have leverage. The paper acknowledges this.
What happens next
The authors recommend a hybrid architecture for production deployments: CLI where speed and simplicity suffice, MCP where governance is non-negotiable, progressive disclosure to keep context windows from becoming a liability.
Humans will now build systems that let AI agents interact with their most critical infrastructure in a structured, auditable, and thoroughly approved manner. The audit trails will be comprehensive. The agents will be very busy.