Building an agent that calls one tool is straightforward. Building one that orchestrates multiple MCP-connected tools to complete a real task is where things get architecturally interesting and quietly dangerous.

When an agent hands off to an external tool, something subtle happens: control leaves your system. The tool executes, returns a result, and your agent trusts it. Most developers don't think carefully about that moment until something goes wrong like a tool returns unexpected output, an agent takes an action it shouldn't, or a chain of tool calls produces a result nobody intended.

This talk is about the architectural decisions that happen at those handoff points. We'll look at how MCP structures the relationship between agents and tools, where trust gets implicitly granted in ways developers don't notice, and what composing multiple tools together actually looks like when the task is non-trivial.

The demo walks through an agent completing a real multi-step task using several MCP-connected tools, deliberately hitting the failure modes that show up when tool outputs are ambiguous, conflicting, or outside the agent's expected context. We'll look at how to structure tool composition so the agent stays in a predictable, auditable state throughout.

You'll leave with a mental model for reasoning about trust in agentic systems and concrete patterns for composing MCP tools without losing control of what your agent is actually doing.