A CLI, the command line, is the surface we set aside years ago in the name of “security,” and it’s worth a second look. Agents are text creatures, and the command line is their first language. Give an agent a CLI and it can drive your system out of the box, because it already knows how a terminal works. Left wide open it exposes everything the system can do; run inside a locked-down environment, it can be fenced in tightly. The surface itself draws no lines. You do.
The API is the surface with guardrails: defined endpoints, predictable answers, real limits on what you can reach through it. It’s what an agent calls when it needs to do something precisely and at scale. Every serious platform has one now, which is why having one stopped being a selling point.
MCP, Model Context Protocol, is the frontier. It’s an open standard, now run under the Linux Foundation and backed by every major AI platform, that hands an agent a labeled set of tools and states up front what each one does and what it can’t touch. Why it matters is pure economics. In an agentic world the cost of using a system isn’t a license, it’s tokens — the compute an agent spends every time it reads, reasons and acts.
A platform an agent has to fight to understand is expensive to operate against; one that hands it a clean, defined toolset is cheap. That gap is tiny per call and enormous at scale, and it decides which platforms agents get pointed at. The same definition that makes MCP cheap to run also makes it governable: the provider decides what’s on the menu. Think of an API as the keys to the building and an MCP server as a visitor badge that opens only certain doors and gets logged at each one.
SDKs are the courtesy layer: kits in the languages people already use, so nobody rebuilds the authentication and the error handling from scratch. They turn an integration that takes a quarter into one that takes a week.
CLAMS is best read as a direction of travel. The bar is moving toward all four faster than vendors keep up, which is why the question to ask isn’t “do you have an API” but “what can an agent actually do with this, and where is it headed.”
And the incumbents are moving. Established panel vendors, not just startups, are shipping natural-language agents that confirm an action before taking it and log every one, and rewriting their APIs to be friendly to agents, not only developers.
Standards are a different promise than control
One caution. An MCP server bolted onto a proprietary, closed data model still traps you; it just traps you in nicer language. Open surfaces only pay off sitting on open standards, where the credential, the reader, the protocol, and now the AI layer speak something other than one vendor’s dialect.
I’ve made a version of this argument about credentials for years: the logo on the badge doesn’t have to match the logo on the wall. It’s true one level up now. The agent you use to run a building shouldn’t have to come from the company that sold you the access system.
Getting systems to talk to each other is one promise. What an agent is allowed to do once they’re talking is a different one, and the standard rarely answers that part — it falls to whoever deploys the thing. Which is why “open” sounds reckless to anyone with their name on a service contract.
But I’m the one on the hook for the SLA
That’s the worry that should be nagging at every provider who sells a service instead of a product: my customers pay me for a result, not a system, and I’m the one who eats it when the result doesn’t show up. If any agent can do anything to the system I’m responsible for, how do I stand behind a number I no longer control?
Right worry, wrong target. The free-for-all isn’t openness, it’s ungoverned openness — a surface that exposes everything with nobody defining the limits. A wide-open CLI does that, and so does a naked API. Which is exactly why a provider selling an outcome doesn’t hand those out without fencing them first.
This is where MCP earns its keep. The provider decides in advance what an agent may do, which doors stay shut however the request is phrased, and every action gets logged. You don’t lose control of the outcome; you’re the one defining it. That’s the badge from earlier, and it’s already shipping.
So the letters read differently from different chairs. From a credential platform, more surfaces is simply more open. From a managed-services chair, you lead with MCP and govern it hard, and you don’t expose a wide-open CLI you’d then have to fence in yourself, because “ungoverned” is the one word you can’t put next to “SLA.” That isn’t a watered-down version of openness. If anything it’s a more deliberate one, and almost nobody is making the case for it.
The people worried about commoditization have it backwards. Managed services gets more valuable here, not less. Once every facilities manager has an agent that can act, the scarce thing isn’t the ability to do something, it’s the willingness to answer for it when the agent gets something wrong at two in the morning.
What the customer is paying for, in the end, is that someone owns the result. The cost of the work falls because the agent does the clicking, but the price of owning the outcome holds. The moat moved: it used to live in how painful leaving was, now it lives in who answers for the result. Integrators run the same play, billing less for wiring and more for judgment.
What you’re buying
The buying question has changed shape. You’re not purchasing a system anymore. You’re purchasing a spot in an ecosystem and the answer to two questions instead of one. What can an agent do with this thing? And when it does something, who’s standing behind it? A platform no agent can operate is a dead end. A platform any agent can operate with nobody accountable for the result is a liability. The thing worth paying for lives between those two — open enough to plug into everything, governed enough that someone can still promise you an outcome.
Click Here For The Original Source.
——————————————————–
