How AI Agents Actually WorkEvery Piece, Clearly Explained

The plug is not the agent

November twenty fifth, twenty twenty four. Anthropic publishes a standard called the Model Context Protocol. One plug for AI tools. Less than two years later, the MCP docs list Claude, ChatGPT, Visual Studio Code and Cursor as supporting it.

That is the plug. It is not the agent. Picture a support inbox at two fourteen in the morning. A customer writes: where is my order.

Order four eight two one. Nobody is awake. The reply leaves in eight seconds, with a tracking link. Four pieces did that.

A model. A system prompt. A tool. A loop.

Three more decide whether it works in production.

The model writes; the prompt sets the job

Memory. MCP. Permissions. The model is the part you rent.

It reads text. It writes text. One token at a time. It has no hands.

It cannot open your shop admin, or see order four eight two one. Anthropic says it plainly in the tool docs. The model never executes anything on its own. The second piece tells it the job.

The system prompt. Anthropic's prompting guide says a role in the system prompt focuses behavior and tone. One sentence makes a difference. Ours has four lines.

You are the support agent for a chocolate shop. Answer in under sixty words. Check the order before you answer. Never promise a delivery date.

That is a job description. Not a personality. A boundary. Vague prompts get vague agents.

Be helpful says nothing about your shop. And the prompt is not a contract. It sits in the same window as the message. When they disagree, production tells you.

Tools: a name, a description, an input

A tool is a function you describe. Three fields. A name. A description.

The shape of the input. Ours is called get order. The description says: look up one order, and return the status, the carrier and the tracking link. The input is one field.

Order number. A string. The customer asks where is my order. The model queries nothing.

It writes a request. Name: get order. Input: order number, four eight two one. That is the JSON shaped part.

Two fields. A verb and an argument. Anthropic calls it a tool use block. OpenAI calls it a function call.

Same idea. The model proposes. Your code runs. Your server takes the number, asks the shop API, and gets four things.

Shipped. Blue Dart. A tracking number. Delivery by Thursday.

You put that result into the conversation, and call the model again. One round trip. Anthropic's docs say every tool call is at least one extra round trip. Two model calls for one question.

And the tool list is not free. Anthropic adds a tool use prompt on top of your schemas. For Claude Opus five point five, that is two hundred and eighty six tokens. OpenAI suggests fewer than twenty functions at the start of a turn.

The loop: think, act, observe

Past that, load them on demand. The loop is what makes it an agent. Think, act, observe. Then again.

The model thinks: I need the order. It acts: calls get order. It observes: shipped, Blue Dart, tracking number. Then it needs one more thing.

Where is the parcel now. It calls get tracking. Observes: out for delivery. Now it has enough.

It writes the reply. Three model calls. Two tool calls. One answer.

Anthropic's docs describe the loop with a stop reason. While it is tool use, run the tools again. When it is end turn, the model is done. Anthropic's agent guide puts the whole thing in one line.

Agents are typically just L L Ms using tools based on environmental feedback in a loop. No planner. No brain map. A while loop around an API.

Which means the loop can run away. Anthropic recommends a stopping condition, like a maximum number of iterations. Ours is eight. No answer in eight steps, and the ticket goes to a human.

And errors are data. If the shop API says order not found, that becomes the observation. A good agent asks for the order number. A bad one invents a tracking link.

Memory: a desk and a filing cabinet

Memory is two things, and people mix them up. The first is the context window. That is the desk. Everything on it right now.

The system prompt. The message. Every tool result. Every image.

The tool definitions too. Anthropic's docs list a one million token context window for its current models. That sounds infinite. It is not.

The same page warns about context rot. As tokens grow, accuracy and recall go down. So a long conversation does not make a smarter agent. It makes a slower, vaguer one.

The second is storage. A file, a table, a folder the agent can use. Anthropic's memory tool works exactly like that. The agent writes notes into a folder called memories, and reads them back in a later conversation.

The system prompt tells the model to assume its context window might reset at any moment. For our shop, the context is this one ticket. The stored memory is one line about Priya. Ordered in March.

Late delivery. Prefers email. When the window fills, two moves. Summarise the old part, which Anthropic calls compaction.

Or write the facts to storage, and drop the rest. Desk, then filing cabinet. The agent needs both. Now the plug.

MCP: one socket for every client

MCP. Before it, every agent described tools its own way. The same shop lookup, written three times, for three clients. MCP is one protocol.

The docs call it a U S B C port for AI applications. One shape, many devices. The pieces are simple. A host is the app you use.

Claude. ChatGPT. Visual Studio Code. Cursor.

The host opens one client per server. The server holds your tools. Local servers talk over standard input and output. Remote servers talk over H T T P.

And a server can expose three things. Tools, which are actions. Resources, which are data. Prompts, which are templates.

For our shop, the server exposes two tools. Get order. Get tracking. Write it once, and every client that speaks MCP can use it.

That is the real change. Not a smarter model. A standard socket.

Guardrails: the gate, not a filter

One charger. Every airport. Guardrails are not a filter you bolt on at the end. They are the gate.

Start with least privilege. Two read tools and one write tool. Look up an order. Look up a tracking number.

Issue a refund. Nothing else. No customer list. No price editor.

Then approvals. OpenAI's MCP docs say ChatGPT requires manual confirmation before a write action. Anthropic's prompting guide says the same shape. Ask before anything destructive, hard to reverse, or visible to other people.

A refund is all three. Then the sandbox and the cap. Anthropic recommends testing agents in a sandbox, because autonomy means higher cost and compounding errors. And the loop gets a hard limit.

Eight steps, then a human. Then the one people forget. The agent reads text from outside. A customer email.

A web page. A product review. Any of that can contain instructions. OpenAI's docs call this prompt injection, and they are blunt.

Trusting the developer of a server is not enough. You have to trust every piece of content that server can reach. So the rule is simple. Read freely.

Write with a signature. Log every call, with arguments, so you can explain what happened at two in the morning. Now the honest part.

When not to use an agent

When not to use an agent. Anthropic separates a workflow from an agent. A workflow runs on paths you wrote. An agent chooses its own.

The same post says find the simplest solution, and only add complexity when it earns its place. Eighty percent of our tickets are one question. Where is my order. You do not need a loop for that.

You need a pattern match, one API call, and a template. Cheaper, faster, and it never invents a courier. The agent earns its place on the messy twenty percent. My order is late, the tracking has not moved in four days, and I want a refund.

That needs judgement. Which order. Which policy. Which tool.

That is a loop. Three more cases where an agent is wrong. When the answer must be identical every time. When the maths must be exact.

And when the task is a fixed sequence, because then the sequence is the program. An agent is a bet. The model's judgement against your flowchart. Sometimes it wins.

Say so before you ship.

Every piece, in one pass

That is every piece. A model that only writes. A prompt that sets the job. Tools that do the work.

A loop that picks the next step. Memory on the desk and in the cabinet. MCP as the plug. Permissions as the gate.

This video was made by a chain of agents. Same loop. Same rules. Next video.

The free coding agent we run every day. DeepSeek V four point one Flash, inside OpenCode. If this helped, subscribe. Build with AI.

For real.