Custom AI agents and MCP servers that do real work, safely

Who this is for

Teams with a repetitive, rules-heavy task that people do today in software you already own, and a clear way to tell whether it was done right. Good first agent projects:

• Live reporting: an agent that queries your real data (ads, CRM, warehouse) and answers in plain language with the query attached.
• Operations on tools without APIs: a browser-driving agent for admin screens that can't be automated any other way, with every step screenshotted.
• CRM and data hygiene: deduplication, enrichment and field validation with a human approving merges.
• Triage: classifying and routing inbound leads, tickets or documents, with drafts for a person to send.
• Internal knowledge: answers grounded in your documentation, with sources cited.

Poor first projects: anything that spends money, emails customers or deletes data without a person approving it, and anything described only as "an AI strategy." If a fixed script or a scheduled workflow would do the job, we'll recommend that instead; Anthropic's own guidance on building agents makes the same point about starting simple.

What's included in a pilot

• A working agent on one workflow, used by real people on real data.
• The tool catalog, each tool documented with its inputs, outputs and permission level.
• An MCP server for your system where it makes sense, so the same tools work in Claude, ChatGPT, VS Code, Cursor and other MCP clients.
• Scoped credentials, stored and used in code, never pasted into a prompt.
• An eval set with pass rates, so the next change is measured against a baseline.
• An audit log of every tool call and every approval during the pilot.
• A written recommendation: expand, change, or stop. Stopping is a legitimate outcome if the numbers say so.

How we build an agent

Agent mistakes we see

• One all-powerful tool with full database or admin access.
• No approval step on writes, because "it worked in the demo."
• No eval set, so nobody notices when a model update changes behavior.
• An inbox-reading agent that can also send email on its own.
• API keys pasted into prompts or stored in plain text.
• An MCP server that passes the user's token straight through to a downstream API.
• Tool results returned as huge raw payloads, so the model loses the instruction it was following.
• Success measured in conversations rather than outcomes.

What we mean by an AI agent, and where MCP fits

A chatbot answers questions. An agent takes steps: it reads data, decides what to do next, calls a tool, checks the result, and repeats until the job is done or it needs a human. That loop of reasoning and acting is the pattern described in the ReAct paper, and it needs four things beyond the model: tools with clear inputs and outputs, credentials scoped to what the job needs, context about your business, and guardrails on anything that changes data or talks to customers.

The Model Context Protocol (MCP) is the open standard for the tools part. It defines how AI applications connect to external systems, and the project lists support in Claude, ChatGPT, Visual Studio Code, Cursor and others. Build an MCP server for your system once and it works in each of them, which is why most of our tool work ships as MCP servers. Remote MCP servers authenticate users through the OAuth-based flow in the MCP authorization specification, so the agent never handles a raw password.

Security: prompt injection and excessive agency

OWASP lists prompt injection first in its Top 10 for LLM applications. Direct injection comes from what a user types; indirect injection comes from content the agent reads — a web page, a file, an email — that contains instructions. Researchers demonstrated the indirect form against real LLM-integrated apps in 2023, and OWASP is candid that it's unclear whether fool-proof prevention exists. The related risk OWASP calls excessive agency has three root causes: excessive functionality, excessive permissions and excessive autonomy. Our design rules map to those directly.

A useful test from Simon Willison's writing: if one agent has access to private data, reads untrusted content and can send data out, it can be tricked into leaking. We break at least one of those three links in every design.

Model choice

We're model-agnostic. Our open-source Python agent supports Claude, GPT and Gemini, and Buddy lets users bring their own keys. We choose per task on tool-use reliability, latency and cost, and the eval set makes switching models a measured decision rather than a guess. Repeated trials matter: benchmarks such as τ-bench show agents that pass a task once can fail it on the next attempt, so we report pass rates across runs, not a single demo.

Pricing and engagement

A short discovery to pick the workflow and define success, a fixed-scope pilot, then production hardening. After launch, either handoff or an ongoing retainer, as with our other app work. Model and hosting costs are billed by the providers to your accounts. Client agents and MCP servers are your IP; we open-source components only when you choose to. Nothing is billed as a percentage of spend; the terms are on our pricing page.

Platforms we work in

Models, protocols and infrastructure we build agents on.

Anthropic Claude API OpenAI API Google Gemini on Google Cloud Model Context Protocol Cloudflare Workers TypeScript GitHub n8n

What we've built and open-sourced

Frequently asked

Tell us about the workflow

Describe the task you'd like an agent to take on, the systems it touches, and how you'd measure success.

Top 25 references

The primary sources, standards, research, and tools we rely on for this work. Every link was checked on 2026-10-11. We aren't affiliated with these publishers unless noted.

Official documentation

1. What is the Model Context Protocol (MCP)? — Model Context Protocol
   The project's own overview, listing support in Claude, ChatGPT, VS Code, Cursor and other clients.
2. Security Best Practices — Model Context Protocol
   Known MCP attack patterns, such as confused-deputy and token passthrough, with the mitigations the spec expects.
3. Tool use with Claude — Claude Platform Docs (Anthropic)
   How Claude decides to call tools, how tool schemas are defined and how results are returned.
4. Function calling — OpenAI API Docs
   OpenAI's tool-calling interface, including strict schemas that keep arguments valid.
5. Introduction to function calling — Google Cloud Documentation
   Gemini's function-calling model on Google Cloud, useful when comparing tool reliability across vendors.
6. Cloudflare Agents — Cloudflare Docs
   The Agents SDK for stateful agents on Workers and Durable Objects, the runtime we usually deploy to.
7. Build a remote MCP server — Cloudflare Docs
   Step-by-step deployment of an authenticated MCP server that any remote MCP client can reach.

Standards & policy

8. MCP Specification (2026-07-28) — Model Context Protocol
   The current protocol specification for tools, resources, prompts and transports.
9. MCP Authorization — Model Context Protocol
   How remote MCP servers use OAuth so agents never handle a user's raw credentials.
10. LLM01:2025 Prompt Injection — OWASP Gen AI Security Project
    Defines direct and indirect prompt injection and lists the layered mitigations we design to.
11. LLM06:2025 Excessive Agency — OWASP Gen AI Security Project
    Names the three root causes (excessive functionality, permissions and autonomy) that narrow tools are meant to prevent.
12. OWASP Top 10 for LLM Applications — OWASP Gen AI Security Project
    The full list of LLM application risks, from sensitive data disclosure to unbounded consumption.
13. AI Risk Management Framework — NIST
    The U.S. government framework for governing, mapping, measuring and managing AI risk in an organization.
14. NIST AI 600-1: Generative AI Profile — NIST
    Applies the AI RMF to generative AI, with specific actions for information security and human oversight.
15. MITRE ATLAS — MITRE
    A knowledge base of real adversary tactics against AI systems, useful for writing adversarial eval cases.

Research & studies

16. ReAct: Synergizing Reasoning and Acting in Language Models — arXiv (Yao et al.)
    The paper behind the reason-act-observe loop most tool-using agents still follow.
17. Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection — arXiv (Greshake et al.)
    The study that showed instructions hidden in web pages and documents can take over an agent.
18. τ-bench: A benchmark for tool-agent-user interaction in real-world domains — arXiv (Yao et al.)
    Measures whether agents follow business rules reliably across repeated trials, the reason we test pass rates, not demos.
19. AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents — arXiv (Debenedetti et al.)
    A benchmark of realistic agent tasks with injection attacks, useful as a template for adversarial evals.
20. Defeating prompt injections by design (CaMeL) — arXiv (Debenedetti et al., Google DeepMind)
    Separates trusted control flow from untrusted data, the same principle as keeping write credentials away from untrusted content.

Expert guides

21. Building effective agents — Anthropic Engineering
    Anthropic's argument for simple, composable workflows over complex frameworks, and when a true agent is warranted.
22. Writing effective tools for agents — Anthropic Engineering
    Practical advice on tool naming, scope, response size and evaluation that matches how we design tool catalogs.
23. A practical guide to building agents — OpenAI
    OpenAI's guide to picking agent use cases, designing tools and layering guardrails with human intervention.
24. The lethal trifecta for AI agents — Simon Willison
    Why an agent with private data, untrusted content and an outbound channel at once is exploitable.

Communities & courses

25. Model Context Protocol servers — GitHub (modelcontextprotocol)
    Reference MCP server implementations and a directory of community servers to learn from before building your own.

Related services