MCP collapses M-by-N tool adapters into a single JSON-RPC 2.0 contract

Put numbers in the M and the N. Five orchestrator clients and twenty tools is 100 pairwise adapters under the point-to-point pattern the dev.to walkthrough describes ^[1]. Under one shared contract, each of the twenty-five parties implements the protocol once, so 25 implementations cover the same matrix, a factor of four ^[1]. Ten clients and fifty tools is 500 against 60 ^[2]. The ratio climbs toward the smaller of the two counts and never passes it ^[3]. Maintenance relief only shows up if the contract is the thing that absorbs upstream change, because the specific failure named in the piece is a schema edit forcing a redeploy in all M clients ^[2].

The three prompt-level costs in the article are stated as architecture, not measured. Static context is the sum of the injected schema sizes ^[5]. Self-attention cost is quadratic in sequence length ^[7]. Neither expression cares how a schema reached the prompt. A host that connects six servers and still injects every tool definition at the start of a session ^[4] pays the prefill it paid with hand-written adapters. Attention dilution survives standardisation for the same reason: the model still sees schemas it does not need, and the author attributes hallucinated parameters and failure to invoke the right tool to exactly that condition ^[6].

Isolation, in this design, sits in the process layout and not in the wire format. A server is a separate lightweight process, and the host manages its lifecycle ^[13][12]. Deciding that a tool call is needed belongs to the client ^[11]. Validating the request and presenting the consent prompt belongs to the host ^[12]. A consent prompt is a boundary for as long as the user reads it. The attack the article centres on is indirect prompt injection, where instructions arrive inside data the model retrieved and turn into arbitrary shell commands or exfiltration over an outbound socket ^[8]. The alternative it gives for hosts without a sandboxed protocol is binary: block tool capabilities entirely, or run them with the full privileges of the host process ^[9].

The text breaks off as it starts to trace the bidirectional JSON-RPC 2.0 message flow through the stack ^[14][15], so the transport question stays open here. I would adopt the contract for the redeploy problem alone ^[2]. I would not treat the prompt budget or the injection surface as handled by it, since both depend on what the host injects and what it approves ^[4][12].