An agent is an LLM that works in a loop: it receives a goal, decides on a step, calls a tool (read a file, run tests, query a database, call an API), looks at the result and decides the next step — until it thinks it is done.
Workflows vs agents
Anthropic's engineering guidance draws a useful line:
- Workflows: LLMs and tools orchestrated through predefined code paths ("generate the test, run it, if it fails retry twice").
- Agents: the LLM dynamically directs its own process and tool use.
Their advice is to find the simplest solution possible and only add complexity when it is needed. Many reliable "agent" products in engineering are really well-designed workflows.
Tools are where the risk lives
The model only produces text. Tools turn text into actions. An agent with a read-only code search tool is low-risk; an agent with a shell, production credentials and network access can do real damage. Later levels cover least privilege, sandboxes and approvals.
The Model Context Protocol (MCP)
Before MCP, every AI tool needed custom connectors to every system. Anthropic introduced MCP in November 2024 as "an open standard that enables developers to build secure, two-way connections between their data sources and AI-powered tools." An MCP server exposes a system — a code host, issue tracker, database, observability tool — in a standard way, and any MCP-capable assistant or agent can use it.
In December 2025 Anthropic donated MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI, which makes it a vendor-neutral standard.
What this means in practice
- MCP servers become part of your platform: you will want a registry of approved servers, owners and permissions.
- Each MCP server is also attack surface: it can expose data or actions to any agent that connects, and it reads untrusted content.