Cheat sheet: Tools and agents

Tool/function calling: the model emits a structured call (a name and JSON arguments that match your schema) and never executes anything. For your own tools, your code validates, authorises and executes, then returns the result linked to the call id. Provider-hosted tools (web search, code execution) run on the provider’s side.

Agent = LLM in a loop. ReAct pattern: Thought, Action, Observation, repeated until the goal is met, a budget is hit, or the agent is stuck. Build the exits yourself: done criterion, step, time and cost caps, loop detection, human escalation, tracing.

Planning: plan-then-execute (predictable, reviewable, brittle) vs reactive step-by-step (adaptive, more calls). Start with the simplest design; a workflow beats an agent when the path is predictable.

Quick answers#

• Tool calling: model proposes a JSON call; your code validates, authorises from the real session, applies timeouts, bounded retries and idempotency keys, then executes. Strict mode helps format only.
• ReAct: Thought, Action, Observation; add step caps, loop detection and tracing.
• MCP: host, client, server; tools (model-controlled), resources (application-driven), prompts (user-controlled); stdio or Streamable HTTP; composes with function calling. The host mediates, so the USB-C analogy hides the trust problem.
• MCP revisions: date-versioned. 2026-07-28 (checked 2026-10-09) is stateless: no handshake, no protocol sessions, server/discover, multi round-trip requests; sampling, roots and logging are deprecated. Earlier revisions up to 2025-11-25 use the handshake. Check the current spec before building.
• MCP risks: injection via descriptions and results, over-broad or passed-through tokens, rogue or changed servers, unapproved writes, state handle hijacking, too many tools.