Give Your Agent Hands — MCP Tooling Lab

09:00 – 10:15

See what tool calling actually is

—the tool loop on the wire, schemas as the contract, where MCP fits

—Takeaway One tool call read message by message — request, decision, invocation, result — so nothing later is folklore.

10:30 – 11:45

Design tools a model cannot misuse

—schema design, naming and descriptions that steer, failing usefully

—Takeaway A vague tool redesigned until the model stops misusing it — the improvement measured in call error rate.

12:00 – 13:00

Wire in your first MCP server

—connecting existing servers, discovery, scoping what is exposed

—Takeaway An off-the-shelf MCP server connected to your application — with half its tools deliberately switched off.

14:00 – 15:15

Let it read a real API

—external APIs as tools, auth at the boundary, response shaping

—Takeaway The model answering questions it can only answer by calling a live API — keys never entering the prompt.

15:30 – 17:00

Let it read your database, safely

—read-only access patterns, query scoping, what must never be exposed

—Takeaway Natural-language questions answered from a real database through a scoped read-only tool — and one forbidden table proved unreachable.

09:00 – 10:15

Give it a business action

—actions vs reads, side effects behind tools, transaction boundaries

—Takeaway The model completing a real business operation through a tool — with the write path wrapped in a transaction it cannot escape.

10:30 – 11:45

Put a human before the consequence

—approval gates, what needs approval and what does not, escalation

—Takeaway A consequential action paused for explicit approval — and proceeding cleanly after it, demonstrated both ways.

12:00 – 13:00

Hold the security boundary

—least privilege per tool, credentials and secrets, injection through tool results

—Takeaway A prompt-injection attempt arriving through a tool result — caught at the boundary instead of obeyed.

14:00 – 15:15

Trace everything it does

—tool-call tracing, audit logs, cost of tool-heavy conversations

—Takeaway A trace that accounts for every tool call in a session — who asked, what ran, what it returned, what it cost.

15:30 – 17:00

Wire the full application and defend it

—API plus database plus action together, the access review, demo

—Takeaway Your application using all three systems in one conversation — demoed, traced, and its access defended to the room.