The Agent Stack - Part 6: Tools, MCP, and Capability Surfaces

2026-02-17 · Source: The Agent Stack · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Software Development & Engineering, Cybersecurity & Data Privacy · Depth: Advanced, long

Summary

The article clarifies that "tools" in AI systems are not merely function calls but "capability surfaces" that define the actions and context an AI model can access. It emphasizes the critical distinction between a model's request and the system's decision to act, highlighting the complex layer of considerations like tool visibility, identity, scope, context, user approval, and execution environment. The Model Context Protocol (MCP) is introduced as a standard for exchanging these capabilities and context, separating primitives like resources, prompts, and tools. The author stresses that while schemas define request shapes, they do not grant authority, and tool output should be treated as context with provenance, not inherent truth, due to potential for staleness, untrusted sources, or malicious content. Different types of tools, such as hosted, local, and computer-use tools, carry varying operational responsibilities and risk profiles.

Key takeaway

For AI Architects designing agentic systems, you must prioritize robust capability surface design over simple function calling. Your architecture needs to explicitly separate schema definition from authorization and approval workflows, ensuring that tool visibility, identity, and scope are tightly controlled. Treat all tool output as untrusted context until its provenance and validity are confirmed, and implement granular approval paths for high-impact actions to mitigate risks like excessive agency and indirect prompt injection.

Key insights

AI tools are capability surfaces, not just function calls, requiring careful boundary design for security and control.

Principles

• Schema validates shape, not authority.
• Tool output is context, not truth.
• Expose fewer, narrower tools.

Method

Design capability surfaces by filtering tools per run, keeping them narrow, separating schema from authority, binding identity explicitly, and treating tool output as untrusted context until validated.

In practice

• Use `create_reply_draft` over `send_email`.
• Validate tool results against schemas.
• Implement explicit approval for sensitive actions.

Topics

• Agent Stack
• Tool Calling
• Capability Surfaces
• Model Context Protocol
• Authorization & Policy

Best for: AI Engineer, AI Architect, AI Security Engineer

Related on AIssential

• The AI Agent Security Surface: What Gets Exposed When You Add Tools and Memory — AI agents introduce four distinct attack surfaces requiring a new security paradigm beyond traditional LLM prompt defenses.
• Whitepaper Companion Podcast - Agent Tools & Interoperability with MCP — MCP standardizes LLM tool integration, enabling real-world actions and fostering a modular, scalable AI agent ecosystem.
• Critique of Agent Model — Genuine AI agency requires internalizing goal, identity, decision-making, self-regulation, and learning structures, not external scaffolding.
• AI Agent Tool Design: What Works and What Doesn’t — Effective AI agent performance hinges on robust tool design, not just advanced model capabilities.
• The Agent Stack Bet — Current agent deployments suffer from a "stack ceiling" requiring fundamental architectural shifts for enterprise-grade reliability and governance.
• Your agent skill is not an anti-corruption layer — MCP's direct exposure of upstream schemas to LLMs creates architectural debt; use domain-specific tools as Anti-Corruption Layers for robust enterprise AI.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by The Agent Stack.