What is an AI agent?

An agent is a loop: the model asks for a tool, your program runs it, the model reads the result.

Read on 14 November 2026. This field changes fast: check the sources.

The loop

Anthropic's tool use documentation says tools differ mainly by where the code runs. For client tools, including functions you define yourself, the code runs in your application: the model answers with stop_reason: "tool_use" and one or more tool_use blocks, your code does the operation, and you send the outcome back in a tool_result. Server tools, such as web search and code execution, run on Anthropic's infrastructure and you see the results without handling execution. With the default tool_choice of auto, the model decides on each turn whether to call a tool or to answer directly.

An agent is what you get when you repeat this: ask, let the model request a tool, run it, send the result back, and stop when the model gives an answer.

A demonstration with a stand-in

The transcript below is a real run of that loop in this section's tests. The "model" is a small function that stands in for a language model and makes fixed choices; the two tool calls go to a real MCP server (see the page about building one).

user: Add 2 and 40, then say the sum loudly.
model asks for a tool: add({"a": 2, "b": 40})
server result: 42
model asks for a tool: shout({"text": "the sum is 42"})
server result: "THE SUM IS 42"
model (final answer): Done: THE SUM IS 42

Nothing here is artificial intelligence: it shows the shape of the loop. A real model decides for itself which tool to call and with which arguments.

What makes it risky

The program, not the model, performs every action. So the safety questions are about the tools: what each tool is allowed to do, whether a person should approve it first, and what happens when the model asks for something odd. The MCP documentation says that tools are model-controlled, meaning models can discover and invoke them automatically, and it emphasizes human oversight, such as showing tools in the interface and asking for approval.

This is an independent guide. It is not connected with Anthropic or the MCP project. This field changes quickly: statements were read on 14 November 2026 from the pages named under Sources (the MCP site shows specification version 2026-07-28 in its page addresses). The demo server and the messages are real: we ran them with the official Python SDK (mcp 2.3.0). No AI model was used for the demos.