X Discussion: Theo Says LLMs Are "Still So Bad" at Building Tools for Agents, Opus Keeps Botching MCP Authentication, and Warns Not to Trust Agents on MCP "Best Practices"
Theo (@theo), CEO of T3 Chat and T3 Code and a well-known developer YouTuber, posted on November 8 that LLMs are "still SO bad at building tools for agents": every time he asks Opus to set up an MCP authentication path, it "makes horrible assumptions and builds something that straight up doesn't work." About two hours later he added that he is writing an "MCP the right way" guide for his own agents; when he had them draft a first version, they proposed rendering the MCP URL as a clickable link for users, and he warned people not to trust "ANYTHING" agents say about MCP, connection strategies and agent "best practices." At writing time the first post had about 880 likes, 136 replies and 65,000 views.

Key Takeaways
- Original post (@theo, November 8): when he asks Opus to set up an MCP authentication path it "makes horrible assumptions" and builds something that "straight up doesn't work"
- Follow-up (@theo): an agent-drafted "MCP the right way" guide proposed rendering the MCP URL as a clickable link, and Theo called agents "CLUELESS" about MCP and connection strategies
- Engagement (public X data at writing time): about 880 likes, 136 replies, 138 bookmarks and roughly 65,000 views on the first post; about 344 likes, 51 replies and 164 bookmarks on the follow-up
- Context: MCP authorization builds on OAuth 2.1, requires clients to implement PKCE and references several standards including Protected Resource Metadata (RFC 9728) and Dynamic Client Registration (RFC 7591), while stdio transports skip it (MCP spec)
- Replies: some say MCP auth changed several times within a year so training data lags; others suggest giving the model the exact spec plus one working request, and defaulting to the device authorization grant (RFC 8628) on headless servers






