Vocabulary: Agents, Tools, and MCP

Tool calling (function calling) — the mechanism letting a model request an action: tools are declared as schemas in the context; the model emits a structured request; the runtime executes it and returns the result into the conversation. Lives in: the agent layer. Say it: "The model never executes anything — it asks; the runtime acts, with the runtime's permissions."

Tool schema — the declaration a model sees for each tool: name, description, typed parameters. The model can only use tools it's been handed schemas for. Lives in: the contract between model and runtime. Say it: "The schema is the contract — and the runtime validates every request against it before executing."

Structured output — forcing the model to produce machine-parseable output (JSON matching a schema) instead of prose; validated in code, retried on mismatch. Lives in: reliability engineering for AI features. Say it: "Anything downstream code consumes comes out as validated structured output, never free text we regex."

Agent — a model in a loop with tools: propose an action, runtime executes, result returns to context, repeat until the task is done. Lives in: the orchestration layer. Say it: "An agent is just the tool-call loop running — which means agent safety is runtime safety."

Runtime / orchestrator — the code hosting the loop: holds credentials, executes tool requests, enforces least privilege and confirmation gates, logs everything. Lives in: your application code — where all real security lives. Say it: "Every security property of an AI agent is a property of its runtime, not of the model."

MCP (Model Context Protocol) — the open standard for exposing tools and data sources to AI clients: a server declares tools, any MCP-capable client discovers and calls them. Lives in: integration standards — solves the M-apps-times-N-tools problem. Say it: "It's like USB for AI tools — I built one MCP server for our credential-record layout, and any client can use it without custom integration."

MCP server / client — the server side exposes tools (your code, your permissions — e.g., read-only database access); the client side is the AI application that discovers and invokes. Lives in: the MCP architecture. Say it: "I made the database access read-only at the server level — whatever any model asks for, writes are structurally impossible."

Least-privilege tools — granting the runtime only the capabilities the task needs, with consequential actions behind human confirmation. Lives in: AI security; the strongest prompt-injection defense. Say it: "An injected instruction can't do what the system can't do — that's why least privilege comes before any prompt-level defense."

Human confirmation gate — a required human approval step before the runtime performs a consequential action (send, delete, pay, change records). Lives in: the runtime's control plane. Say it: "The AI drafts and proposes; a person confirms anything with consequences."

Context management — strategies for conversations or document sets that outgrow the window: summarization/compaction, sliding windows, external memory, map-reduce over chunks. Lives in: the engineering above the context window. Say it: "A bigger window is not a substitute for retrieval — relevance beats volume, and long contexts degrade in the middle."

Compaction / summarization — replacing older conversation turns with a summary to keep the context within budget while preserving key facts. Lives in: context management. Say it: "Long-running sessions compact — we keep recent turns verbatim and summarize the rest."

External memory — writing durable facts to a store outside the conversation and retrieving them like RAG, instead of dragging the whole transcript along. Lives in: context management; the pattern behind persistent assistants. Say it: "Facts that must survive the session go to a store, not the transcript."