AI Agents Essentials

Not this time. An agent runs in a loop: the model decides which tool to call, sees the result, and decides the next step, until the task is done. A single call returns one answer and stops.

Not this time. The model only returns a request: the tool name and its arguments. Your application runs the function and sends the result back in the next message.

Not this time. MCP is an open protocol for connecting AI applications to outside systems. A server exposes tools, resources and prompts once, and any MCP-capable application can use them.

Not this time. Models choose and fill tools from their names, descriptions and schemas. Clear descriptions with when to use the tool, precise parameter types and enums, and helpful error messages improve calls more than anything else.

Not this time. No prompt can fully stop injection. What limits the damage is what the agent can do: least-privilege tools, no access to secrets, and a person approving irreversible actions.

Not this time. Hard limits in code: a maximum number of turns or tool calls, a token or cost budget, and a time limit, with a clear message when one is hit.

Not this time. Prompt caching stores the processed prefix. On the Claude API a cache read costs a tenth of the normal input price on most models, so a stable prefix resent each turn becomes cheap.

Not this time. Anthropic found multi-agent systems suit broad tasks that split into independent parts worked on in parallel, like wide research, and that they use many more tokens. Tightly coupled tasks, such as most coding, gain little.

Not this time. The context window holds only the current session. To remember across sessions, the agent writes to storage outside the model, such as files or a database it can read back with a tool.

Not this time. Check whether the end state is right (the task was actually done), grade with a rubric where needed (an LLM judge checked against people), and read traces to see where runs go wrong.

Not this time. In orchestrator-workers, a central model decides the subtasks as it goes, delegates them and combines the results. It suits tasks whose parts cannot be known in advance.

Not this time. Compaction summarises the earlier conversation and continues from the summary, keeping the context small. Clearing old tool results and keeping notes outside the context help too.

Not this time. All tool results go back together in a single user message, each matched to its call by tool_use_id. Splitting them across messages teaches the model to stop calling tools in parallel.

Not this time. Return a tool result marked as an error, with a message that says what went wrong and how to fix the call. The model can then retry correctly or choose another tool.

Not this time. Token passthrough is forbidden: a server must not forward the token it received to other services. It must check the token was issued for itself, and get its own token for any downstream API.