Agents, tools & MCP
When to let the model act — and when not to.
Agents let a model plan, call tools, observe results and loop. They're powerful and over-hyped. Your job is to know when an agent is the right tool, how to build one safely, and how to keep it bounded.
Key ideas
- 1
The agent loop: plan → act (call a tool) → observe → repeat until done. Tools are how the model affects the world.
- 2
Prefer the simplest thing that works: a single well-prompted call or a fixed workflow often beats a free-roaming agent. Reach for agents when the path is genuinely dynamic.
- 3
MCP (Model Context Protocol) is the emerging standard for exposing tools/data to models — learn it; it's how you'll integrate enterprise systems.
- 4
Bound your agents: limited tool scope, allow-lists, sandboxing, step/time/cost limits, and human-in-the-loop for risky actions.
- 5
Agents amplify failure modes: prompt injection via tool output, runaway loops, and cost blowups. Observability and guardrails are mandatory.
- 6
Long-running agents do better restarting with a fresh context each iteration than compacting one endless session — keep state in files and git, not in the conversation.
Workflow vs agent
- Workflow: you orchestrate fixed steps (predictable, testable, cheaper) — default choice.
- Agent: the model decides the steps (flexible, needed for open-ended tasks) — use when the task space is dynamic.
- Many 'agents' should be workflows with one or two tool calls.
Building them safely
- Scope tools tightly; treat every tool as an attack surface.
- Sandbox side-effects; require approval for irreversible/expensive actions.
- Cap steps, time and spend; trace every tool call for debugging and audit.
- Treat tool outputs as untrusted input (indirect prompt injection).
Long-running work: the outer loop
For work that outlasts one context window, the instinct is to keep a session alive and let it compact. The better pattern — popularised as the “Ralph” technique, which is literally a bash loop re-running the same prompt — is to let the agent exit and restart it on the same files.
- Every iteration starts at the top of a fresh window; state lives in files and git, not the transcript. Compaction keeps the transcript and loses the attention.
- It converges only because tests, typecheck and lint can mechanically refuse bad work. The loop generates; the checks refuse.
- So where nothing can refuse — design calls, anything judged by taste — a loop does not converge, it drifts confidently and looks finished.
- Bound it on iterations, wall clock and a stop file, and run it sandboxed: unattended loops usually run with approval prompts disabled.
- Cost is the bound people forget. An iteration cap limits tasks, not tokens.
Watch
Reading checkpoint
Finished the ideas above? Bank the reading progress before applying them.
Do the work
0/5 · 0%Test yourself
What is the agent loop?
Go deeper
Playbook · 35 min
How to make your project AI-driven
A field guide for real teams with real repos
27 chapters · progress saves automatically