John Welsh is a software engineer who builds the infrastructure connecting AI models to external applications. His work on the Model Context Protocol at Anthropic addresses a central problem for increasingly capable agents: giving them useful access without proliferating insecure integrations, duplicate authentication, and difficult-to-monitor network connections.
Welsh studied mechanical engineering at California Polytechnic State University, San Luis Obispo, focusing on control systems and robotics. His professional history includes engineering leadership at Workday and work on automation and templating at Asana. At Anthropic, he has worked on tool calling, its public API, and internal systems for connecting models with external services.
An architecture for useful, governable agents
- Separate protocol from transport. Welsh treats MCP’s JSON-RPC messages as the durable interface between models and tools. External integrations can use Streamable HTTP and OAuth, while internal systems can communicate over WebSockets, gRPC, or Unix sockets without changing the underlying protocol.
- Centralize integration through an MCP gateway. A shared gateway provides one connection interface while handling OAuth and credential management, outbound connectivity, rate limiting, and observability. Engineers can reuse integrations across applications without repeatedly implementing authentication or exposing sensitive tokens throughout an organization.
- Make security part of the architecture. Standardized traffic creates a practical enforcement point for auditing, restricting untrusted servers, inspecting tool requests, and mitigating prompt injection. Welsh calls this design a pit of success: making the secure engineering choice the easiest one.
- Reuse protocol primitives. MCP sampling lets integrations request model work while individual applications retain control of their own billing, token limits, and usage accounting.
Welsh also contributed to Anthropic’s guidance on designing effective agent tools, which emphasizes realistic evaluations, clear tool descriptions, useful returned context, and economical token usage. His AI Engineer World’s Fair 2025 talk brings these concerns together: shared interfaces, flexible implementation, and security controls concentrated where an entire organization can reuse them.
