AI Agent、MCP、工具调用、多 Agent 协作
This collection features articles and community discussions in the Agent 工程 space, focusing on real-world engineering scenarios, tool selection, practical paths, and risk boundaries.
The page is continuously updated and serves as a learning roadmap, technology selection reference, and technical review entry point.
An agent should not hold a master credential covering an entire session. This article designs short-lived capability leases issued by a policy broker, binding tools, resources, call counts, executor keys, and a revocation epoch.
A successfully fetched tool list does not mean the Agent sees a complete and still-authorized capability set. This article combines paginated discovery, descriptor validation, policy filtering, and invocation binding into a versioned catalog generation that blocks half-loaded catalogs and late-arriving changes from reaching the execution plane.
A successful tool call does not mean the returned content is trustworthy. This article designs a bounded response envelope, strict JSON Schema, typed fact extraction, HTML and URL sanitization, malicious fixture testing, and per-tool isolated rollback.
External web pages, RAG fragments, and tool results remain untrusted even after being summarized. This article designs taint tags that propagate with data across steps, deterministic sink policies, audit events, attack testing, and isolated rollback.
Prompt Injection cannot be solved with a single “ignore malicious instructions.” This guide builds defense in depth across six layers: trust boundaries, least privilege, content isolation, tool authorization, output validation, and red-team testing.
The hard part of Function Calling is not getting the model to return a function name, but handling wrong tool selection, argument drift, duplicate execution, timeouts, and partial success. This article presents a complete design for tool contracts, executors, idempotency, retries, and confirmation mechanisms.
Human review is more than adding a confirmation button. This article designs risk-based routing, evidence packages, queue priorities, SLAs, and feedback loops so Agents remain controllable on high-risk tasks without sacrificing low-risk automation efficiency.
Function Calling is how an Agent affects the real world, but several engineering gates separate “the model wants to call a tool” from reliable completion. This article explains the mechanism, parallel and multi-round calls, argument validation, error recovery, and its relationship with MCP, taking function calling from working to production-ready.
MCP Server audit logs need more than a one-line success or failure entry. This article covers call correlation IDs, authorization decisions, input/output summaries, sensitive-field redaction, retention policies, and event queries that provide an evidence trail for security and troubleshooting.
URL mode accept only means that the user agreed to navigate; it does not prove that authorization or payment was completed. This article separates form data from sensitive credentials and binds user identity, target domains, completion notifications, and retries of the original request.
A successful `initialize` does not let either side add or remove features freely during a session. This article seals the protocol version, both parties’ capabilities, implementation identities, and the `initialized` boundary into an auditable receipt, preventing existing connections from using capabilities negotiated only later.
The most dangerous failure in a multi-tenant MCP Server is not an error, but silently returning Team A’s data to Team B. This article presents a complete isolation design spanning identity context, query constraints, caching, tool parameters, and testing strategy.