Lean Agents: Decide What Your Agent Can Reach Before It Runs
Every tool you connect to an agent is two things at once: tokens the model reads on every run, and an action the model can take. So the same inventory answers your cost question and your permission question. I start every agent with that inventory, and with nothing connected that the task doesn't need. I talked through this with Tom Smith on CoderLegion's Developer Stories ( video , from 9:46).…
The cost and permission aspects of an agent are determined by the tools it connects to. Each tool provides a name, description, JSON Schema for input, and the client typically shares these definitions with the model. A study by Anthropic shows that using tools from five servers such as GitHub, Slack, Sentry, Grafana, and Splunk took about 55,000 tokens before the conversation even began (Anthropic engineering).
The permission side is straightforward: if a tool is listed, the model can choose to use it. To manage access, an agent should have its own sandbox environment with only the access granted, employing a zero-trust approach within the system. Two other controls include creating a per-task tool allowlist, choosing specific server and tool permissions, and setting a run budget with limits on tool calls, total tokens, and wall clock timeout.
Monitor each tool call during the agent's operation, recording arguments and results to detect any potential missteps. The established MCP spec suggests logging tool usage for auditing, implementing timeouts, and rate-limiting tool invocations (MCP tools specification). By following these steps, you can identify issues and make necessary adjustments.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
