Agents, tools and MCP

The loop where a model calls tools, when a fixed workflow is better, MCP as the plug for tools, and how to keep it from running away.

0/6
☰
Agents · architecture

An agent is a model calling tools in a loop. The hard parts are around it: choosing when a fixed workflow is enough, plugging tools in through MCP, and keeping the loop from running away.

+ The whole system in one paragraph

An agent lets the model choose its next step: it asks for a tool, your code runs it, the result goes back in, and it decides again. That flexibility costs tokens, predictability and safety. This page shows when a fixed workflow is the better choice, how a tool call really works, how MCP connects tools to any AI app, and the limits, permissions and human approvals that keep an agent in bounds.

In this lesson

6 chapters · ~9 min · a quick check in each

Everything is on this page — just scroll down ↓

New to this? Warm up first+ optional
1
At a glance

Words you'll meet

Skim these now and come back whenever a word shows up. Token, context window and tool call mean the same here as in the earlier topics.

ⓘ Details & sources

The terms, in plain words.

TokenA small piece of text, a short word or part ofone. Models read and are billed in tokens.Context windowEverything the model can see in one call: yourprompt plus the answer it's writing.Tool callThe model asks your code to run a function;your code runs it and replies.WorkflowModel calls and tools wired together by YOURcode: the steps are fixed in advance.AgentA model that picks its own steps: it callstools in a loop until the task is done.Agent loopYour code that repeats: ask the model, run thetool it wants, send back the result.OrchestratorYour code that builds each prompt, decides whatto fetch or call, and runs the loop.SubagentAn agent started by another agent to do onepart of the job, then report back.MCPModel Context Protocol: an open standard forplugging tools and data into any AI app.Host · client · serverIn MCP: the AI app (host) holds one client perserver; a server offers tools and data.JSON schemaA description of what a JSON object must looklike: its fields, their types, which arerequired.Strict modeThe provider guarantees the tool call matchesthe schema.stdio · Streamable HTTPThe two ways MCP messages travel: through alocal program's input/output, or as HTTP POSTsto one URL.JSON-RPCA simple message format: a request with amethod and an id, and a reply with the same id.Step budgetThe most steps or tokens a run may use beforeit's stopped.OWASPA nonprofit security project; its 2025 Top 10for LLM apps numbers the biggest risksLLM01–LLM10.Prompt injectionText that tries to give the model orders.'Indirect' when it hides in a page or file themodel reads.Excessive agencyAn agent with more tools, permissions orfreedom than its job needs (OWASP LLM06).Least privilegeEach tool and key gets only the access itneeds, nothing more.Human in the loopA person approves certain actions before theyhappen.
Chapter 1 of 6

The whole picture

2
Pipeline

From one call to an agent, one piece at a time

Anthropic's advice: start simple and add complexity only when it measurably helps. Each step solves a problem the one before couldn't. 'The architecture of an AI app' covers steps 1–2.

ⓘ Details & sources

Most features stop at step 2. Each later step costs more and must earn its place.[1][15]

1 · Augmented LLMa call + tools1several steps2 · Workflowyour code decides2steps unknown3 · Agent loopthe model decides3many tools4 · + MCP serversa standard plug4real actions5 · + Limits & approvalbefore real users5huge, parallel tasks6 · Multi-agentonly if it pays6

6 steps. Follow the flow one step at a time — what happens first, and what comes next.

3
Architecture

An agent, on one page

Your loop sits between the model and the tools: every tool call passes the approval gate, then an MCP client. A step budget caps the run. The model only asks — your code decides what runs.

ⓘ Details & sources

Click a box, then play a flow: three tool calls, a refund that waits for you, and a page that tries to take over.[1][5][13]

Watch it happen:
MCP servers12count5check3allowed3434User: The person who gives the agent a task, and who approves its risky actions.Userasks · approvesStep budget: A counter that stops the loop after too many steps or too many tokens.Step budgetmax steps · tokensAgent loop: Your code: it sends the task to the model, runs the tools the model asks for, and feeds the results back.Agent loopyour orchestratorApproval gate: A check before each tool runs: allowed? risky? If risky, a person must say yes first.Approval gatepolicy · human OKModel: The AI model. It reads the task and the results so far, then answers or asks for a tool.Modelpicks the next stepMCP clients: Connectors inside your app. Each one talks to one MCP server and lists its tools.MCP clientsone per serverFiles: An MCP server running on the same machine, reading and writing files.Filesstdio · localDatabase: An MCP server that queries your database with a role that can only read.Databaseread-only roleWeb fetch: A remote MCP server that downloads web pages for the agent to read.Web fetchStreamable HTTPRefunds: An MCP server that can move money. Every call to it needs a person's approval.Refundswrites · riskyWeb page: Any page on the internet. Its text can contain instructions written by an attacker.Web pageuntrusted
youyour systemoutside services dashed = our simplification
12345
Step 1 of 5

You ask: 'Which orders shipped late last week, and why?' The loop starts with the task.

Quick check

The model asks to call a tool. Who actually decides whether it runs?

Pick one — or just keep scrolling, it's not graded.

Keep going — it's free

Create your free account to unlock the rest of this lesson, keep your progress and pick up right where you left off.

  1. 2Workflow or agent?
  2. 3Tool calls up close
  3. 4MCP
  4. 5Keeping it safe
  5. 6Multi-agent and cost
Create my free account →I already have one — log in