Advanced30 min

Tools & MCP

How agents call the outside world — and how MCP standardizes that interface.

By the end of this lesson, explain tool calling and how the Model Context Protocol makes tools interoperable.

How deep?
How the pieces actually move.

A model can only produce text. Tools are how that text turns into action: the model emits a structured request to call a function, the runtime executes it against a real system (a search, a database, an API), and feeds the result back. Everything an agent *does* — as opposed to says — goes through a tool.

First, the whole system

First, see the whole system. Then we’ll open it up.

Tool call round-trip

Tool call round-trip

  1. The model emits a structured tool call; the runtime invokes the real tool/API and returns the result as an observation the model can use.
flowchart LR
  model[Model] -->|structured tool call| runtime[Runtime]
  runtime -->|invoke| tool[Tool / API]
  tool -->|result| runtime
  runtime -->|observation| model

Each tool is described by a schema (name, purpose, parameters) that goes into the model's context so it knows what's available and how to call it. The Model Context Protocol (MCP) standardizes this: an MCP server exposes tools, resources, and prompts over a common protocol, so any MCP-aware client can use them without bespoke integration — the way a common API contract decouples services.

Abstraction leak

This is where the abstraction starts leaking.

Every tool schema you expose is spent context — and attack surface. The model can only reliably choose among a modest set of well-described tools; flood it with hundreds and selection degrades. Tool schemas are also a token tax on every single request, whether or not they're used.

Over-permissioned tool

Trigger
An agent is given a tool with broad authority and no per-call authorization.
Symptom
A hallucinated or manipulated tool call performs a damaging real-world action.
Blast radius
Whatever the tool can reach — data, money, infrastructure.
Mitigation
Least-privilege tools, per-call authorization, human confirmation for high-impact actions, audit logs.

Deep dive: Privilege Escalation

Authority

Powerful tools make an agent more capable but widen blast radius and attack surface; narrow, read-only tools are safer but limit what the agent can accomplish. Tool design is fundamentally an authority-scoping decision.

What problem does MCP solve for tools?

Interoperability — it standardizes how tools/resources are exposed so any MCP-aware agent can use them without a custom integration per tool.

Tools let an agent act on real systems — which means real authority and real blast radius. Who decides what an agent is allowed to do?

Next: Agent Identity →