# Agents, tools, and MCP

> An agent is a loop with tools — MCP is how you plug in external capabilities cleanly.

Canonical: https://www.brainyxai.co.za/education/claude/agents-tools-mcp
Markdown: https://www.brainyxai.co.za/md/education/claude/agents-tools-mcp.md
Course: Claude Operator Track
Lesson: 7 of 9
Minutes: 18
Author: Brainyx AI

## What you will be able to do

- Define an agent as model + tools + loop + stop conditions
- Explain what MCP adds vs one-off tool functions
- List safety filters before exposing tools to users

## What “agent” means here

An **agent** is not a personality skin. It is:

1. A model that can propose actions  
2. **Tools** it may call (search, DB, calendar, shell, CRM…)  
3. A **loop** that feeds tool results back until a stop condition  
4. **Permissions** and logging around those tools  

Without tools, you have a chatbot. With tools and no approvals, you have an incident waiting to happen.

## MCP in one paragraph

[Model Context Protocol (MCP)](https://docs.anthropic.com/en/docs/agents-and-tools/mcp) standardizes how hosts (Claude Desktop, Claude Code, your app) discover and call tools from **MCP servers**. Instead of hard-coding every integration, you attach servers (filesystem, GitHub, internal APIs) and filter which tools are visible.

Operator rules:

- Start with **read-only** tools  
- Narrow filesystem roots  
- Allowlist tools when a server exposes dozens  
- Log tool calls in production  

## Design a thin agent first

Bad first agent: “Do anything in our SaaS.”  
Good first agent: “Draft a reply from KB article X; never send; human clicks send.”

That pattern is how Brainyx AI scopes client agents — **action with a human gate**, then widen.

## Related Brainyx AI learning

- Hermes Agent Operator Track (messaging gateway + MCP in another stack): `/education/hermes`  
- Anthropic Academy MCP / API courses on Skilljar for official labs

## Agent design lab

1. Write a one-page agent card: goal, tools (max 3), forbidden actions, stop condition, human gate.
2. If you use Claude Desktop/Code with MCP, attach one read-only server and list the tools you see.
3. Remove or disable one tool you don’t need — practice least privilege.

## Checkpoints

- My agent has a human gate
- Tools are allowlisted on purpose

## The loop, and the conditions that stop it

An agent is a model, a set of tools, a loop, and — the part teams forget — stop conditions. Without explicit limits, a confused agent will keep trying, calling tools, burning budget, and occasionally taking real actions in your systems.

Define all of these before an agent touches anything that matters:

- **Maximum iterations** — the loop halts even if the goal is unmet
- **Maximum spend** per task, enforced in your code
- **Irreversible action gate** — refunds, sends, deletes, and payments pause for a human
- **Failure behaviour** — what it does when it cannot finish, which should be escalate, not improvise

An agent that stops cleanly and says it is stuck is far more useful in production than one that always produces something.

## Designing the tool contract

Tool quality determines agent quality more than prompt wording does. Each tool needs an unambiguous name, a description written for a reader with no context, explicit parameter formats, and predictable error messages.

Two rules save most of the pain. First, separate read tools from write tools so you can grant them independently. Second, make mistakes structurally hard — if a relative path can be misinterpreted, require an absolute one; if an ID format is ambiguous, validate and reject early.

When an agent misbehaves, check the tool descriptions before you rewrite the system prompt. The fix is usually there.

## What MCP actually changes

Hand-written tool functions bind your agent to your integrations. MCP standardises the interface, so capabilities become pluggable and reusable across agents and clients rather than re-implemented per project.

The trade-off is trust. An MCP server you did not write runs with whatever access you grant it. Review what a server can reach, scope credentials narrowly, and prefer servers you control for anything touching customer data.

## Where agents earn their keep in SA businesses

The pattern that works: a process that currently requires a person to read something unstructured, decide, and then act in two or three systems. Order exceptions, invoice chasing, lead qualification, document intake. Those have clear success criteria and a natural human gate.

The pattern that fails: replacing a deterministic automation that already works. If the steps are fixed and the inputs are structured, an agent adds cost and failure modes for no gain. Brainyx AI's guide to [agents in artificial intelligence](https://www.brainyxai.co.za/blog/agents-in-artificial-intelligence-what-they-are-how-they-work-and-what-to-build) walks the decision in detail.

## Mini-FAQ

**Q: Agent or workflow?**
A: If you can draw the steps in advance, build a workflow. Use an agent when the path genuinely depends on what earlier steps return.

**Q: How do I test an agent?**
A: Replay real historical cases against a staging environment with fake write tools, and score completion and escalation quality — not single-turn output quality.

**Q: Is MCP required?**
A: No. Direct tool functions are fine and often simpler. MCP pays off when you are reusing capabilities across several agents or clients.

## Next lesson

Continue to [RAG versus stuffing the prompt](https://www.brainyxai.co.za/education/claude/rag-vs-context).

Official reference: https://docs.anthropic.com/en/docs/agents-and-tools/mcp

Course hub: https://www.brainyxai.co.za/education/claude · Previous: https://www.brainyxai.co.za/education/claude/api-and-platform · Next: https://www.brainyxai.co.za/education/claude/rag-vs-context