Tool use and MCP for governed analytics agents.

Course 8: Tool Use And MCP

One-hour objective: design a safe tool layer for an AI analytics agent and explain how OpenAI/Anthropic-style tool calls relate to MCP server tools, auth, retries, and sandboxed execution.

Course 8 Reading List

Use three required sources: one OpenAI tool-calling guide, one Anthropic tool-use guide, and the MCP tools specification. Keep the optional refresher for authorization only.

Readiness Checklist

You are ready for the interview version of this topic when you can design a tool interface and defend the operational controls around it.

• You can explain the full tool-use loop: model observes context, requests a tool call, application validates and executes, tool result returns to the model, and final answer is produced.
• You can write a BigQuery tool schema with required fields, constrained enums, output shape, error classes, timeout, retry policy, and idempotency requirements.
• You can separate model permissions from execution permissions: the model can request a tool, but service credentials, tenant scope, and policy checks decide whether it runs.
• You can explain where MCP helps: standardized tool discovery and invocation across clients and servers, not automatic trust in every exposed capability.
• You can name reliability controls for tools: validation, sandboxing, dry-run estimates, retry caps, circuit breakers, cancellation, rate limits, and replayable receipts.
• You can propose evals for tool selection accuracy, argument validity, permission denials, retry behavior, cost guard enforcement, data leakage, and recovery after tool failures.

Interview Drill: AI Infra System Design

Prompt: design a tool and MCP layer for a BigQuery analytics agent that can inspect schema, estimate query cost, run approved SQL, summarize results, and escalate risky requests.

• Start with tool inventory: dataset search, schema fetch, metric-definition lookup, SQL dry run, approved query execution, chart generation, audit log write, and human escalation.
• Define contracts: JSON input schemas, structured outputs, deterministic error codes, max runtime, cost class, side effects, idempotency key, and whether the tool can be called in parallel.
• Place the MCP boundary: BigQuery and governance capabilities live behind one or more MCP servers, while the agent client handles tool selection, policy mediation, and trace assembly.
• Handle auth and sandboxing: map user identity to least-privilege service credentials, enforce dataset-level access, block cross-tenant leakage, and isolate untrusted tool outputs before reuse.
• Add reliability behavior: validate arguments before execution, run dry checks before expensive scans, retry transient errors only, cap step count, preserve cancellation, and return receipts for every call.
• Close with evaluation and operations: golden tool-call traces, adversarial permission probes, cost-limit tests, latency SLOs, MCP server health checks, and incident replay from stored receipts.