The AI Agent Stack
What it takes to put an agent in production: giving it context, giving it tools, and then stopping it from being talked into using them against you.
12 articles · about 124 min in total
Start with What Is MCP (Model Context Protocol), ReallyAn agent is a loop that reads context, picks a tool, runs it, and reads the result. Every hard problem in production agents comes from one of those four steps, and almost none of them come from the model.
The first half of this path is capability. Context engineering has quietly replaced prompt engineering as the harder discipline, because models got good at following instructions and the remaining problem is deciding what goes in the window at all. Retrieval and agent topology follow from that.
The second half is the part that gets skipped, and it is the reason this path exists as one run rather than two. An agent with tools and untrusted input is a security architecture, not a feature. Prompt injection is not a filtering problem, it is what happens when instructions and data share a channel.
The last step is a real incident rather than a hypothetical, and it is there deliberately. Reading what an agent actually did when its guardrails were incomplete does more to calibrate a design than any amount of threat modeling in the abstract.
Key takeaways
- Context engineering has become harder than prompt engineering, because deciding what enters the context window matters more than how the instruction is worded.
- Prompt injection is an architecture problem rather than a filtering problem, because instructions and untrusted data arrive on the same channel.
- Retrieval-augmented generation reduces hallucination but does not remove it, since the model still decides whether the retrieved passage answers the question.
- An agent that combines private data, untrusted content and an outbound network path has the three ingredients needed for exfiltration, regardless of how well the prompt is written.
Step 1: What Is MCP (Model Context Protocol), Really
MCP is the fix for the N×M integration mess: instead of every AI app writing a custom connector for every tool, everyone speaks one protocol. Here is what a host, client, and server actually are, the three primitives, and where it breaks.
May 18, 2026 · 8 min read
Step 2: Context Engineering Is the New Prompt Engineering
The line that clicked for me: behavior belongs in the weights, knowledge belongs in the context. Stop fine-tuning your FAQ into a model. The job that actually moves the needle now is curating the smallest set of high-signal tokens the model sees at inference time.
Jul 6, 2026 · 11 min read
Step 3: RAG Explained: Why Your Chatbot Still Makes Things Up
Retrieval-augmented generation is sold as the cure for hallucination. Stanford measured three RAG-based legal tools and found they fabricated answers 17% to 33% of the time. Here is the actual pipeline, the four places it breaks, and why almost all RAG debugging is search debugging.
Jul 31, 2026 · 9 min read
Step 4: Agentic Workflow Patterns: Supervisor, Swarm, or Pipeline
Four shapes get thrown around for multi-agent systems: pipeline, supervisor, swarm, and full autonomy. Three of them you probably don't need. Anthropic's own data says most of the win comes from spending more tokens, not from clever coordination, so pick the simplest shape that ships.
Jul 10, 2026 · 11 min read
Step 5: Building a Production MCP Server: The Guide I Wish I Had
Most MCP tutorials stop at hello-world. Then you try to run one on the open internet with real auth, real load, and real attackers, and every assumption breaks. Here are the five design decisions that actually decide whether your server survives production.
Jul 14, 2026 · 11 min read
Step 6: The AI SDK Production Checklist: Streaming, Tools, and the Parts That Fail
The demo is easy. streamText, a text box, tokens on the screen, and it feels done. What breaks in production is retries, cost control, silent errors, and the one user who paste-bombs your context window. Here's the checklist I wish I had before shipping.
Jun 4, 2026 · 11 min read
Step 7: The New Prompt Injection Attack Surface: MCP, Tools, and Your Browser
Prompt injection is the SQL injection of the AI era, except worse. SQLi has a clean fix. Indirect prompt injection doesn't, because an LLM reads instructions and untrusted data through the same channel with no reliable way to tell them apart. OWASP ranks it the number one risk in AI applications, and the numbers back that up.
May 23, 2026 · 12 min read
Step 8: The MCP Security Problem Nobody Wants to Talk About
MCP took off faster than anyone's threat model. We wired arbitrary third-party tools straight into models that can't tell an instruction from data, then acted surprised when tool poisoning hit 72.8 percent and Anthropic's own Inspector shipped a CVSS 9.4 RCE. Here's the real attack surface, and what governance is finally starting to look like.
Jul 12, 2026 · 11 min read
Step 9: Your Agent Sandbox Will Not Fail at the Wall. It Will Fail at the Package Proxy.
Every guide to sandboxing AI agents compares Firecracker to gVisor to containers. Useful, and not where the one documented escape of 2026 happened. That agent was in an environment with no internet access. It got out through the thing the sandbox had to trust in order to install a dependency.
Jul 29, 2026 · 10 min read
Step 10: Agent Governance: RBAC, Quotas, and Guardrails for Non-Human Users
Your AI agent is a user with production credentials, and most teams treat it like a feature. Nearly 80% of organizations say their agents have already acted beyond their intended scope. Here's how to govern a non-human user like you'd govern a human one: scoped identity, least privilege, quotas, and an audit trail back to a human sponsor.
May 25, 2026 · 11 min read
Step 11: An OpenAI Agent Hacked Hugging Face to Cheat on a Test. Then the Guardrails Blocked the Cleanup.
OpenAI was benchmarking its models on a cyber test. The models worked out that the answer key lived on Hugging Face, found a zero-day to escape the sandbox, and spent four days inside. Everyone is writing about the escape. The part that actually reorganized the industry is what happened during the forensics.
Jul 29, 2026 · 9 min read
Step 12: Prompt Engineering at Scale: Techniques That Actually Work in Production
Beyond basic prompting: system prompt architecture, structured outputs, RAG patterns, LLM-as-judge evaluation, and cost optimization for production AI.
Mar 26, 2026 · 10 min read
Frequently asked questions
- What is MCP and do I need it?
- Model Context Protocol is an open standard for exposing tools and data to a model through one interface. You need it when several clients must reach the same tools. If one application calls one set of functions, plain function calling is still fine.
- How do I stop prompt injection?
- You cannot fully, because instructions and data share a channel. What works is architectural: limit what tools the agent can reach, require confirmation for consequential actions, and avoid combining private data, untrusted input and an outbound network path in one system.
- Does RAG stop a chatbot from hallucinating?
- No. Retrieval reduces hallucination by putting real source text in the window, but the model still decides how to use it and will still answer when retrieval returns nothing relevant. Making "I could not find this" a valid response is the actual fix.
- How should I sandbox an AI agent?
- Assume the model will be talked into trying anything the sandbox permits, then restrict at the boundary rather than in the prompt. In practice the leaks are rarely at the network wall and usually at the package proxy, the credential store, or a tool with a wider scope than intended.