AI Agents & Tools
Agentic systems — tool calling, orchestration and the interfaces that let models act — with the agent system design, the agentic interview handbook, and a tool-schema designer.
Handbooks 29
The Agentic AI Interview Handbook
Twenty topics every senior AI engineer should be able to reason about live — from eval pipelines to reliability patterns for generative systems.
The Agent Evaluations Handbook
A self-contained handbook on evaluating AI agents — theory, interactive widgets, and practical guidance. Trajectory evals, tool-use scoring, LLM-as-judge, observability, and reliability for PMs, engineers, and founders.
The Agent Patterns Handbook
The design patterns behind every LLM agent — the ReAct Thought–Action–Observation loop, tool/function calling, plan-and-execute, reflection, memory, multi-agent orchestration, and the failure modes (loops, hallucinated tools, recovery, human-in-the-loop) that break agents in production.
The Model Context Protocol (MCP) Handbook
The open standard connecting AI agents to the outside world — why M×N bespoke integrations collapse to M+N, the host/client/server roles over JSON-RPC, the three primitives (tools, resources, prompts), the connect→discover→call session lifecycle, when MCP earns its keep, and the security sharp edges (a server's output is untrusted input).
The Loop Engineering Handbook
Stop prompting your agents — design the system that prompts them for you. The inner vs outer loop, the four loop types (heartbeat, cron, hook, goal), the six building blocks (automations, worktrees, skills, MCP connectors, subagents, external memory), stopping conditions and the verification split, state across runs, cost engineering, and the six failure modes that burn tokens at 3am.
The Context Engineering Handbook
The discipline that replaced prompt-tweaking: curating everything the model sees under a finite attention budget. The anatomy of a production context window, the three taxes on an overstuffed one (context rot, cost, behavioral drift), the four operations (write, select, compress, isolate), agent-specific patterns like compaction and just-in-time retrieval, six production habits, and where it sits in the prompt → context → loop → harness stack.
The Agent Skills Handbook
Packaged, on-demand expertise for AI agents: what a skill folder actually is (SKILL.md + scripts + resources), progressive disclosure and why the system prompt couldn't do it, the skills vs tools vs MCP vs fine-tuning decision table, six habits of skills that actually trigger, and why third-party skills are supply-chain dependencies to review like code.
The Agentic Coding Handbook
Working with coding agents — Claude Code, Cursor and their cousins — without drowning in AI slop. The loop + tools + context anatomy, the CLAUDE.md instruction file (your highest-leverage artifact), the plan-then-verify workflow, skills/subagents/hooks, the vibe-coding review dial, the security sharp edges (injection, secrets, dangerous commands), and the team norms that keep quality from eroding.
The AI Security Handbook
Your app now reads the internet and believes it. Why prompt injection is a design problem filters cannot solve, the lethal trifecta (private data + untrusted content + exfiltration), defense in depth from least privilege to output validation, where PII actually leaks (logs, embeddings, weights), MCP/model supply-chain trust, and the red-team eval suite that gates CI.
MCP vs Function Calling
Pitted against each other, but they live at different layers — like comparing USB-C to sending data. Function calling is the model capability to emit a structured tool request; MCP is the open standard for discovering and connecting to tool servers. How MCP uses function calling, and when each matters.
The Structured Outputs Handbook
How LLMs return guaranteed-valid JSON for function calling and tool use. Why prompting for JSON is unreliable, how constrained decoding masks illegal tokens to −∞ so output is valid by construction (not by hope), the spectrum from JSON mode to full schema enforcement, and the trade-offs — including why "valid" is not "correct". With worked math and runnable code.
The Agent Memory Handbook
A finite context window forces a memory strategy. Short-term (context) vs long-term (external store), how eviction (FIFO) and summarization (compression) keep a growing conversation in the token budget, and how retrieval recalls a fact long after it scrolled out of context — the memory-as-OS idea. With worked budget math and runnable code.
The Guardrails Engineering Handbook
The input and output filters that keep an LLM system safe. Why no single filter is enough, how layering independent guardrails drives the combined miss rate down multiplicatively (defense in depth: ∏ miss_i), why false positives compound the other way (1 − ∏(1−fp_i)), the independence caveat, and where to place each layer. With worked math and runnable code.
The Harness Engineering Handbook
The loop that wraps a model into an autonomous agent — plan, act, observe — and why its most important property is bounds. A stuck agent with no hard stop loops forever, burning money, so the harness enforces max steps AND a cost budget. Geometric success math (P(done ≤ k) = 1 − (1−p)^k, E[steps] = 1/p) and a bounded loop you can run — with worked math and runnable code.
The Sandboxing Handbook
Safely running untrusted or agent-generated code. Why deny-by-default beats a block-list (you can't enumerate all evil, so enumerate the little good), how least-privilege allowlists shrink the escape surface, why resource caps are needed on top of policy, and the layers of isolation from seccomp to microVMs. With worked policy math and runnable code.
The PII in LLM Pipelines Handbook
Handling personal data safely with the redact-before-send pattern: detect PII, replace each value with a stable placeholder before the model sees it, restore the real values in the response — so personal data never crosses the trust boundary to the provider. The leak invariant, consistent placeholders, detection limits, and defense in depth (minimization, BAA/DPA, local models). With worked math and runnable code.
The Multi-Agent Orchestration Handbook
Coordinating multiple LLM agents on one task — and when not to. Why coordination overhead grows quadratically (N(N−1)/2 pairs) while useful work divides only linearly, so past an optimal team size more agents make a system slower, pricier, and less reliable, how to find where the U-curve turns, and the patterns (orchestrator-workers, handoff, routing) that keep coordination near-linear. With worked math and a runnable optimal-team-size calculator.
The Browser & Computer-Use Agents Handbook
LLM agents that operate a UI like a human — no API required. The observe-act-verify loop, why grounding (identifying which element to click on a cluttered, shifting page) is the dominant source of failure, and why grounding errors compound: task success is per-step accuracy to the power of the number of steps (0.9¹⁰ ≈ 35%), so long UI tasks are brittle. Plus the prompt-injection surface. With worked math and runnable code.
The A2A Agent Interop Handbook
Letting heterogeneous agents from different teams work together. The two agreements A2A needs: capability discovery (agents advertise their skills so others can find and route to them) and a shared message schema (so one agent's output chains into another's input). Why both are required — a capable partner you can't talk to is useless — plus schema drift, capability lies, and how A2A relates to MCP. With worked math and runnable code.
MCP vs A2A
Different layers, not rivals: MCP connects an agent to its own tools and data; A2A connects one autonomous agent to another. Why one protocol wasn’t enough for both jobs, and how a single agent uses both — MCP as its hands, A2A as its voice to peers.
Agents vs Workflows
Autonomy is a cost, not a default. Workflows hardcode the path in your own code; agents let the model decide its next step at runtime. Why it’s a spectrum, not a binary, and the decision rule for when unpredictability actually justifies an agent loop.
Agentic Payments
How to let an agent pay without letting it drain your account. The x402 machine-native checkout (HTTP 402: server returns payment terms, agent pays and retries with proof), signed MANDATES that scope spending like OAuth scopes for money (AP2), and spend caps enforced BEFORE execution — authorize ⟺ amount ≤ per-txn AND spent+amount ≤ total AND merchant ∈ allowed. The runaway-agent threat and why the cap belongs in the payment layer, not the prompt. Worked math plus a runnable mandate-and-cap enforcer that stops a looping agent cold at its budget.
Agent Supply-Chain Security
The other door into your agent — the one you open yourself. Every skill and MCP server you INSTALL is third-party code running with permissions, an install-time threat distinct from runtime prompt injection. Why compromise risk compounds with dependency count (1−(1−p)^N: 20 deps at 5% each ≈ 64%), how blast radius = the capabilities a compromised component holds and least-privilege (grant = needed ∩ offered) bounds it, and the two levers — vet to lower p, sandbox to bound damage. Worked math plus a runnable risk-and-blast-radius model.
MCP Apps
Interactive UIs inside Claude and ChatGPT — the first official UI extension to the Model Context Protocol. How a third-party UI runs as a SANDBOXED IFRAME (no ambient authority — can't touch the host DOM, storage, or network), why every capability call crosses a postMessage JSON-RPC bridge (method + params + id, response with the same id), and how the HOST MEDIATES each request against an allowlist (method ∈ allowlist ? execute : error −32601) so the app can only do what the host chose to expose. Sandbox + bridge + allowlist = the whole security model. Distinct from the MCP-server backend. Worked protocol plus a runnable host-mediation gatekeeper.
Self-Improving Agents
Agents that get better from their own production traces improve on exactly two axes, with opposite properties. MEMORY: store a solved trajectory/skill for exact recall — instant to add and forget, but no generalization (a notebook). WEIGHTS: fine-tune on FILTERED correct traces — generalizes to unseen similar tasks, but bakes in what you trained on and is hard to reverse (a habit). Why you filter traces before training (a loop trained on its own confident errors drifts or collapses — same what-you-reinforce-is-what-you-get rule as RL), and the safety rails that follow from permanence: filter first, prefer reversible, canary before rollout, watch for drift/gaming. Cites STaR, Voyager, Reflexion as the mechanism family. Worked math plus a runnable memory-vs-weights model.
Long-Horizon Agents
Why a 10-step task the agent nails becomes a 100-step task it never finishes — reliability COMPOUNDS: a single run of k steps succeeds with probability p^k (95% per step, 100 steps = 0.6%). The fix is engineering, not a better model: CHECKPOINT progress so a failure doesn't restart from zero, and RESUME + retry the failed segment only — a c-step segment retried r times succeeds 1−(1−p^c)^r, so the whole task climbs to [1−(1−p^c)^r]^(k/c), turning that 0.6% into ~51% at the same per-step reliability. The METR time-horizon idea and how reliability engineering extends it. The pass@k-vs-pass^k measurement lives in the agent-evals handbook (linked, not re-derived). Worked math plus a runnable no-checkpoint-vs-checkpointed model.
Agent Skills vs MCP
Agent Skills vs the Model Context Protocol, decided by what each adds: a Skill is packaged knowledge and procedure loaded into the agent’s context to change how it behaves; MCP is a protocol that grants live tools and data over a wire at runtime. Portability, token cost, security surface, and why the two compose rather than compete.
Vibe Coding vs Spec-Driven Development
Vibe coding vs spec-driven development, two ways to build with AI: vibe coding is conversational and exploratory — prompt, run, keep what works; spec-driven development writes a precise spec first and has the agent implement against it with tests as the contract. The spec→plan→tasks→implement loop, where each breaks, and how to combine them.
Claude Code vs Codex vs Gemini CLI
Three terminal-native agentic coding tools from Anthropic, OpenAI and Google that share one loop — read the repo, plan, edit files, run commands, iterate. How they differ on model, extensibility, openness and permissions, what the reported mid-2026 market numbers say (handled with care), and how to actually choose.
Roadmaps 4
AI Harness Roadmap
A visual transit-map roadmap to build an AI harness — the runtime around a model that turns it into an agent. From the messages API, tokens, and structured output through tool calling, the agent loop, context management, memory, and sandboxing to permissions, subagents, evals, observability, and cost control. 18 stations across 3 tracks — Model I/O, the Agent Loop, Production.
Security Engineer Roadmap
A visual transit-map roadmap to a security engineering career — from breaking systems to defending them. From the security mindset, cryptography, identity and web vulnerabilities through threat modeling, offensive security, cloud and container security, detection and incident response to DevSecOps, zero trust, securing AI/LLM systems and GRC. 18 stations across 3 tracks — Foundations, Offense & Defense, Modern Frontiers.
Agentic AI Engineer Roadmap
A visual transit-map roadmap to become an agentic AI engineer in 2026 — the year's fastest-growing engineering title. From what an agent actually is, the agent loop, tool use, MCP and memory through planning, multi-agent orchestration, control planes, A2A interop, agentic coding and self-improvement to evals, long-horizon reliability, guardrails, security, supply chain and agentic payments. 18 stations across 3 tracks — Agent Foundations, Building Agents, Production & Safety.
SOC Analyst Roadmap
A visual transit-map roadmap to become a security operations center (SOC) analyst in 2026 — the defensive, blue-team path. From what a SOC does, networking for defenders and the attacker playbook (MITRE ATT&CK) through logs, SIEM, alert triage, investigation and incident response to SOAR automation, the AI-assisted SOC, detecting AI-era threats and the analyst career. 18 stations across 3 tracks — Security Foundations, Detection & Response, The Modern & AI-Era SOC.
AI System Designs 18
Design a Conversational AI
Build a production conversational AI system (think ChatGPT). See how the request path splits an inference gateway from the model servers, how the context window is assembled and token-budgeted, how conversation memory is stored and recalled, how tokens stream back over a persistent connection, and how guardrails gate every prompt and response.
Design an AI Agent System
Build an autonomous AI agent. See how the plan-act-observe loop turns a goal into action, how the model emits typed tool calls, how a sandboxed executor runs them safely, how working and long-term memory fit together, and how budgets and approval gates keep a multi-step agent from running away.
Design Multi-Agent Orchestration
Build a multi-agent orchestration / workflow engine. See how an orchestrator decomposes a goal across specialist agents, when NOT to go multi-agent, how shared state coordinates them, how a durable workflow engine checkpoints and resumes, how typed handoffs stop telephone-game degradation, how fan-out/fan-in parallelizes independent work, how budgets and termination prevent runaways, and why uncapped agents loop and burn unbounded cost — through an interactive diagram.
Design an Agent Memory System
Build a long-term memory system for an LLM agent or chatbot. See why stuffing the whole history into context fails, how short-term (context window) and long-term (persistent) memory differ, how the write path extracts salient facts, how context is assembled under a token budget, how memories live in vector + structured stores, how recall is RAG over memory, and why consolidation and forgetting keep memory coherent.
Design a Code Execution Sandbox
Build a secure code execution sandbox for untrusted, LLM-generated (or user-submitted) code — the runtime behind code agents, online judges and notebooks. See why running code directly is a full compromise, how containers and microVMs isolate it, how resource limits stop hangs and fork bombs, the submit→isolate→capture pipeline, why sandboxes must be ephemeral, how warm pools keep it fast, and how egress control prevents exfiltration.
Design a Computer-Use Agent
Build a computer-use / browser agent — the agent whose only API is the screen. See how the see-think-act loop works one verified action at a time, why perception mixes screenshots with accessibility trees, how set-of-marks grounding turns "click Submit" into coordinates, why execution lives in a disposable sandboxed VM, how every action is verified against the next frame, where approval gates catch irreversible clicks, and how task memory survives 60-step workflows — through an interactive diagram where you can change the page mid-task.
Design a Deep Research Agent
Build a deep research agent — the system behind every "deep research" product. See how a lead agent decomposes the question into a coverage plan, why parallel sub-researchers get isolated contexts, how the search-read-note loop compounds understanding, why evidence lives as claims-paired-with-sources, how gap-driven iteration ends under a hard budget, and how citation verification keeps the final report honest — through an interactive diagram where you can poison a source.
Design an Adaptive AI Tutor
Build an adaptive tutoring system like Khanmigo or Duolingo's AI tutor. See why a fixed question order fails every learner, how a per-skill mastery model picks the next problem, why grading routes structured answers to a deterministic checker and reserves the LLM for open-ended judgment, how the mastery feedback loop closes, why explanations are grounded in a curriculum knowledge base instead of freely generated, how a Socratic hint ladder avoids just giving away the answer, and how a long-term learner profile drives spaced repetition.
Design an AI Code Review Bot
Build an automated PR review bot like CodeRabbit or Graphite. See why cheap deterministic linters run before any LLM call, how review is scoped to the diff plus just enough context, how a repo embedding index (RAG over the codebase) supplies cross-file context the diff alone can't show, why every finding is confidence-gated before posting, how a comment ledger prevents re-pushes from spamming old feedback, how secrets are redacted before they ever reach the LLM, and how developer reactions tune down false positives over time.
Design an Agent Control Plane
Build the platform layer that runs a whole fleet of production AI agents — not how one agent coordinates a task, but how an organization deploys, versions, budgets, permissions, monitors, and can instantly kill any of potentially hundreds of independently-running agents. See why ad-hoc agent scripts are an operational blind spot, a central agent registry with versioning, server-enforced per-agent tool permissions, hard cost budgets checked per step, an out-of-band kill switch, full execution tracing, and canary rollout of new agent versions.
Design an Autonomous Email Agent
Build an AI agent that triages, drafts, and sends email on a user's behalf, where sending is often irreversible. See why auto-sending everything is dangerous, a human-approval gate scoped to action reversibility, priority triage, context assembly from thread history, tone/style matching, defending against indirect prompt injection hidden in received email, and a full audit trail.
Design a Sales CRM Agent
Build an AI agent embedded in a CRM that enriches leads, scores priority, drafts outreach, and suggests next actions — writing into a shared system of record and staying a suggester, not an autonomous actor, for relationship-sensitive interactions. See multi-source enrichment with provenance tracking, lead scoring, write-back validation that fails closed, next-best-action suggestion, personalization at scale, activity logging, and stale-data safeguards.
Design a Support Resolution Agent
Build an AI agent that triages, resolves, and escalates customer support tickets end-to-end. See why answering from general knowledge alone is dangerous when the real answer depends on account-specific state, grounding responses in real account/order data, confidence-based escalation instead of guessing, tiered auto/assisted/escalate resolution, seamless handoff context, outcome-based quality tracking, tone-aware de-escalation, and identity verification against social engineering.
Design a CI Test-Generation Agent
Build an agent that automatically generates tests for new and changed code in a CI pipeline. See why manual tests leave coverage gaps, coverage-gap analysis, generating tests against the real code, mutation testing to verify a test is actually meaningful, flaky-test detection before it poisons CI signal, why a human review gate is still required, and running expensive validation in a background lane.
Design an Agent Payment Gateway
Build the platform that lets autonomous agents pay for things mid-task without draining an account — the agent rails, not the human card rails. See why a direct payment credential gives an agent unbounded, unscoped spending power, routing every payment through one mediated gateway, verifying a signed spending mandate (signature, scope, expiry) instead of trusting the agent's claim, enforcing per-transaction and cumulative spend caps BEFORE any settlement, machine-native x402 (HTTP 402) settlement with no human checkout, an immutable audit trail of every decision, and why the gateway must fail closed — so a runaway or hijacked agent is capped at the mandate, not the credit limit.
Design an MCP Security Gateway
Build the security layer between an AI host and the MCP servers it connects to — the MCP-protocol-specific threat surface, not a generic LLM guardrail. See why a direct connection implicitly trusts untrusted third-party servers, routing all MCP traffic through a mediating gateway, an explicit server/tool allowlist (deny by default), scanning tool descriptions for injection (attacker-controlled text the model reads as instructions — a channel unique to MCP), issuing narrowly-scoped short-lived tokens per server so a compromised one is bounded to its slice, egress control against exfiltration through tool results, an immutable audit trail, and why the gateway must fail closed.
Design an Agentic Browser Security Gateway
Build the enterprise perimeter that contains a whole fleet of agentic browsers without banning them — the fleet-level layer, not one agent's own injection defenses. See why ungoverned agentic browsers are an invisible exfiltration surface (and why a ban just creates shadow usage), routing every action through one gateway, a central org-wide policy engine, taint tracking so data from an untrusted web page can't drive a sensitive action (provenance beats detection), an action allowlist with risk classification, human-approval breakpoints for the irreversible minority, and a fleet-wide immutable audit trail.
Design a Hybrid Edge-Cloud Agent
Build an on-device agent that runs on the NPU by default and escalates hard queries to the cloud — but where privacy, not just confidence, decides what may leave the device. See why default-to-cloud is default-to-leak, answering on-device by default, a privacy classifier that gates escalation FIRST (must-stay-local data is answered locally even when the model is unsure), confidence-based escalation only for privacy-cleared queries (the cascade math lives in the LLM Router design), redaction to minimize what leaves, and an on-device escalation audit — capability and privacy reconciled by making the boundary a hard constraint confidence can never override.
Paper Breakdowns 12
ReAct
The blueprint for AI agents. Interleave reasoning with actions so a model can think, use a tool, observe the result, and think again — the Thought–Action–Observation loop that grounds reasoning, cuts hallucination, and underpins every tool-using agent.
Toolformer
How a language model taught itself to use APIs. Toolformer learns, self-supervised, to call a calculator, search, QA, translation, and calendar — inserting API calls into text and keeping only the calls that make its next-word prediction better. The recipe that seeded modern tool-using AI agents.
MemGPT
An operating system for LLM memory. Context window as RAM, external storage as disk, and the model as its own memory manager — paging facts in and out with function calls, revising core memories when facts change, and summarizing under memory pressure. The architecture behind modern agent memory (and Letta).
Reflexion
Agents that learn from their own mistakes — reinforcement through words instead of weights. Fail, write a verbal reflection on why, store it in episodic memory, retry with the lesson in context. Actor + Evaluator + Reflector took GPT-4 from 80% to 91% on HumanEval, and the pattern now lives inside every self-correcting agent.
Voyager
The Minecraft agent that never stops learning. An automatic curriculum picks the next just-hard-enough goal, the agent writes code to achieve it, debugs against environment feedback, and saves every verified program to a compounding skill library. 3.3× more items, 15.3× faster tech tree — and the blueprint for agents that build their own tools.
Generative Agents
The Smallville paper: 25 LLM characters living in a simulated town. A memory stream retrieved by recency × importance × relevance, reflection trees that turn events into beliefs, and plans that bend to interruptions — producing a Valentine's party that organized itself. The memory architecture behind modern persistent agents.
Kimi K2
A trillion parameters built for agents. A 1T-param open MoE (32B active) trained through 15.5T tokens with ZERO loss spikes via MuonClip (Muon + QK-clip), plus large-scale synthesis of tool-use episodes so agentic behavior is pretrained, not bolted on. The moment open weights led on agent workloads.
SWE-bench & SWE-agent
Can a model do real software engineering? SWE-bench grades models on resolving actual GitHub issues — the patch must apply, make the failing tests pass, and break no passing tests. SWE-agent gives the model an Agent-Computer Interface (search/open/edit/run) built for the model, not humans. The strict resolution rule and why the interface matters — worked math plus runnable code.
RT-2
A Vision-Language-Action model that controls a robot by emitting actions as text tokens. RT-2 discretizes each dimension of a continuous action into bins — one vocabulary token per dimension — so a web-pretrained vision-language model co-trains on internet data and robot trajectories and its semantic knowledge transfers to control, generalizing to objects and commands never seen in robot data. Action-as-token, quantization precision, and emergent generalization — worked math plus runnable code.
Genie
A generative interactive environment that turns an image into a frame-by-frame playable world — trained on unlabeled video with no action labels. A latent action model infers a small discrete set of actions from consecutive frames, and a dynamics model turns them into control, so a tiny codebook forces consistent, reusable latent actions to emerge unsupervised. Latent-action inference and controllable generation — worked math plus runnable code.
LLMs Get Lost in Multi-Turn Conversation
The ICLR 2026 Outstanding Paper that measured a failure everyone had felt: give a top model a fully-specified task in ONE prompt (concat) and it shines; split the IDENTICAL requirements across several turns (sharded) and 15 leading LLMs fall apart — ~39% average drop. The decomposition is the punchline: APTITUDE (best-case ability) barely moves, but RELIABILITY craters — the spread between a model's best and worst runs roughly DOUBLES. The mechanism is premature commitment: handed partial info, the model guesses a full answer early, locks it in, and when a later turn contradicts it "gets lost and does not recover." A small decay model captures the shape — concat R=p (flat), sharded R=p·(1−q)^(turns−1) (geometric decay), so longer chats get less reliable and the whole loss lives in a reliability term while the ceiling p is untouched. Fixes: front-load the spec, or consolidate/recap a long chat back into one fresh full-spec message. Worked math plus runnable code.
GPT-5.6 System Card
A modern system card is really a COMPUTE-ALLOCATION POLICY, not one model. TIERED ROUTING (reported Sol/Terra/Luna) sorts each query by difficulty — cheap fast tier by default, escalate the hard cases (the cascade cost math lives in the model-routing handbook — linked, not re-derived). ULTRA MODE spends test-time compute in PARALLEL: run several independent agents (reported 4) on the hardest task and a VERIFIER keeps any that solves, so the solve rate is 1−(1−p)^N. The fresh angle = why FOUR, not forty: the marginal value of the N-th agent is Δ(N)=(1−p)^(N−1)·p — geometric decay (p=0.6: +0.60/+0.24/+0.10/+0.04) while cost is linear in N, so there's a knee. Runnable proves best-of-N rises, marginal=(1−p)^(N−1)·p, diminishing returns, 4th≪1st, value/cost decreasing, and finds the knee. PREPAREDNESS: safety case must cover the STRONGEST config (top tier + full ultra), not the cheap default. Cross-links o1-system-card (scaling curve) + model-routing/ai-cost-engineering + self-consistency. Worked math plus runnable code.
Coding Challenges 6
Retry with Exponential Backoff
Tools time out and APIs rate-limit — a production agent retries without hammering. Exponential backoff waits longer after each failure (1s, 2s, 4s, 8s…) up to a cap. Compute the delay schedule: delay[i] = min(cap, base·2ⁱ). Solve it in Python or TypeScript.
Trim History to a Token Budget
Every agent turn re-sends the whole conversation, so history must fit the context budget. Keep the most recent messages that fit and drop the oldest — the trimmer at the heart of context management. Solve it in Python or TypeScript.
Parse a Tool Call
When a model wants to act, it emits a call like search(query=cats, limit=5). Parse that string into a function name and typed arguments before the harness can dispatch it — the little parser that turns a model's intent into an action. Solve it in Python or TypeScript.
Run the Goal Loop
The engine of loop engineering: attempt the front task, let an independent verifier judge it, retry failures with state untouched, and stop when the goal is met — or loudly when the cap trips. Implement the whole outer loop as one pure, testable function. Solve it in Python or TypeScript.
Write a Verifier
In RL from verifiable rewards, the verifier IS the reward — and a gameable one is worse than none, because every false positive is a lie the model learns. Write a verifier a reward-hacking agent can’t fool: recompute the score from ground truth, demand exact task coverage, and compare types-intact. Solve it in Python or TypeScript, with hidden tests.
Build Your Own Agent Loop
Strip an "AI agent" of its mystique and what’s left is a loop: read the model’s next move — tool call or final answer — run the tool, feed the observation back, repeat until it answers or the step cap trips. Implement the whole ReAct inner loop as one pure function. Solve it in Python or TypeScript, with hidden tests.
Labs 5
The Loop: Agent Loop Simulator
Don't read about the agent loop — run it. Step a model through plan → act → observe: it thinks, calls a tool, reads the result, and loops until it can answer. Watch the context window fill turn by turn and compaction fold old turns away before it overflows — the beating heart of every AI harness, made playable, with theory and a quiz.
The Break-In: Prompt Injection
Don't read about prompt injection — try to pull one off. Feed a helpful agent a booby-trapped message that tries to steal its secret or hijack its tools, and watch it get owned. Then switch on real defenses — instruction hierarchy, input sanitizing, output filtering, tool permissions — and watch the same attack bounce. The #1 security risk in LLM apps, made playable, with theory and a quiz.
The Loop Designer: Outer Loops
Don't read about loop engineering — break a loop, then fix it. An agent must migrate 8 files overnight, unattended; you design its outer loop. Toggle the hard cap, the independent verifier, and the external memory, hit Run, and watch the classic failures fire live: the $500 runaway, groundhog-day amnesia, and victory declared on broken code. Four scenarios, one lesson — same agent, different loop, opposite outcomes.
The Crowded Desk: Context Rot
Don't read about context rot — cause it. Give a model a bigger window and it should get smarter, right? Bury one crucial fact in a wall of filler and find out. Slide the needle from top to bottom to watch it sink in the middle, pour in filler to watch recall rot as the desk fills, then toggle retrieval, repositioning and compaction to claw it back. Three acts — lost in the middle, the rot curve, fight back with context engineering.
The MCP Playground
Don't read about MCP — watch a model use tools through it. The Model Context Protocol is a standard way to connect an AI host to external tools and data: servers advertise tools with schemas, the host discovers them, the model decides which to call and with what arguments, the server runs the tool, and the result flows back for the model to answer. Step through a real request — get the weather, then save it to notes — and see the whole discover, call, result, answer loop, with theory and a quiz.
Interactive Tools 5
Tool-Schema Designer
Compose a tool/function definition field by field — name, description, parameters, required flags — and export valid tool-use JSON for the Claude and OpenAI formats, with the JSON Schema generated for you. Stop hand-writing function-calling schemas and fighting silent validation errors.
Context Window Visualizer
Set the tokens for your system prompt, tools, chat history, RAG context and output reserve, pick a model window (8K–1M), and watch a stacked bar fill it. The moment it overflows, the tool shows exactly how much compaction would have to trim from history and retrieved context to make the request fit.
Agent Loop Cost Estimator
An AI agent cost estimator. Enter the steps per task, the tokens added each step, and your model’s input/output prices to see the cost per task, per day and per month — and why re-sending a growing context each step makes cost scale with the square of the steps, not linearly. Shows where prompt caching helps.
Agent Time-Horizon Explorer
An interactive projection of the METR “time horizon” trend — the length of task an AI agent can complete at 50% reliability, which has been doubling on a regular cadence. Set the current horizon and the doubling period, and the tool projects the calendar date when agents cross the one-hour, one-workday, one-week and beyond thresholds. Every assumption is a slider, so you can stress-test the optimistic and conservative cases yourself.
Skill Linter
A client-side linter for agent skill files (SKILL.md). Paste your skill and it scores the structure a good skill needs — a clear name and description, an explicit “when to use” trigger, concrete examples, imperative step-by-step instructions, and a scoped length — against a 12-point rubric, with per-criterion feedback on what is missing. Everything runs in your browser; nothing is uploaded. Built to catch the quality gaps that separate a curated skill from the average public one.
About AI agents & tools
An agent is a language model given a goal, memory and the ability to act — through tools it can call. The core loop is plan → act → observe: the model decides what to do, emits a structured tool call, your code runs it, and the result feeds back into the next decision. That loop is what turns a model that only talks into one that gets things done.
The hard parts are the ones this topic covers: designing tool interfaces the model can use correctly, deciding when a task needs multiple coordinated agents (and when that's overkill), and — most importantly — bounding autonomy with budgets and termination so an agent doesn't loop forever. Evaluating agents honestly is the other half; a demo that works once is not a system.