MCP and REST Work as Layers for AI Agents, Not Rivals
*WorkOS contends that MCP servers should wrap existing REST APIs rather than replace them when exposing services to autonomous agents.*
The sponsored post on Daring Fireball states that REST endpoints serve human developers building against an API, while MCP serves agents that now attempt to use the same services. The piece argues that most teams treat the two as competing standards and feel forced to choose. Instead, the post describes them as stacked layers, with MCP servers typically calling REST endpoints internally to perform the actual work.
The post notes that effective MCP servers avoid converting every endpoint into a discrete tool. They instead organize capabilities around the tasks an agent needs to complete. Shipping an MCP server also requires shipping OAuth 2.1 with scoped tokens for secure access. WorkOS AuthKit already implements that specification, removing the need for teams to build their own authorization layer.
The post offers no performance numbers or adoption figures. It presents the layered approach as the practical path for teams that already run REST APIs and now face agent traffic.
Why it matters
Teams maintaining public APIs face growing requests from autonomous agents. Treating MCP as an additional access layer on top of stable REST endpoints lets them keep existing developer integrations intact while adding agent-specific interfaces. The emphasis on scoped OAuth 2.1 tokens highlights that security boundaries remain essential once agents begin acting on user data. Organizations that follow the advice will likely spend engineering time on task-oriented MCP design rather than duplicating backend logic.
---
Sources:
No comments yet