Give Your Agent Hands: MCP Tooling Lab

09:00 – 10:15

See what tool calling actually is

the tool loop on the wire, schemas as the contract, where MCP fits

Takeaway One tool call read message by message (request, decision, invocation, result) so nothing later is folklore.

10:30 – 11:45

Design tools a model cannot misuse

schema design, naming and descriptions that steer, failing usefully

Takeaway A vague tool redesigned until the model stops misusing it, the improvement measured in call error rate.

12:00 – 13:00

Wire in your first MCP server

connecting existing servers, discovery, scoping what is exposed

Takeaway An off-the-shelf MCP server connected to your application, with half its tools deliberately switched off.

14:00 – 15:15

Let it read a real API

external APIs as tools, auth at the boundary, response shaping

Takeaway The model answering questions it can only answer by calling a live API, keys never entering the prompt.

15:30 – 17:00

Let it read your database, safely

read-only access patterns, query scoping, what must never be exposed

Takeaway Natural-language questions answered from a real database through a scoped read-only tool, and one forbidden table proved unreachable.

09:00 – 10:15

Give it a business action

actions vs reads, side effects behind tools, transaction boundaries

Takeaway The model completing a real business operation through a tool, with the write path wrapped in a transaction it cannot escape.

10:30 – 11:45

Put a human before the consequence

approval gates, what needs approval and what does not, escalation

Takeaway A consequential action paused for explicit approval, and proceeding cleanly after it, demonstrated both ways.

12:00 – 13:00

Hold the security boundary

least privilege per tool, credentials and secrets, injection through tool results

Takeaway A prompt-injection attempt arriving through a tool result, caught at the boundary instead of obeyed.

14:00 – 15:15

Trace everything it does

tool-call tracing, audit logs, cost of tool-heavy conversations

Takeaway A trace that accounts for every tool call in a session: who asked, what ran, what it returned, what it cost.

15:30 – 17:00

Wire the full application and defend it

API plus database plus action together, the access review, demo

Takeaway Your application using all three systems in one conversation: demoed, traced, and its access defended to the room.