A tiny documentation change can be enough for an agent to flag trusted AWS content as a prompt-injection attack. That failure opens into a broader question: how do you make MCP servers efficient, observable, and safe once real agents start using them?

• Correlating requests across an agent session reveals when ten tool calls could become one aggregate tool, cutting latency, tokens, and LLM round trips.
• Evals need to span models, harnesses, thinking settings, and tool configurations, because narrow test matrices can miss production failures.
• A constrained, schema-validatable DSL could make multi-step agent actions easier for humans to review than generated Python.

Better MCP design comes from measuring agent behavior, then shaping tools around what the data shows.

An agent update can look harmless while quietly asking for broader network, credential, or filesystem access. Docker’s Sandbox Kit Spec v3 puts those permissions inside OCI images, making an agent’s authority versioned, reviewable, and portable with the artifact itself.

• Permissions are declared as typed requests for network hosts, credentials, volumes, and ports, with the host approving or rejecting each one at launch.
• Updates can be compared against previously approved permissions, so non-escalating changes proceed automatically while expanded access requires review.
• Kits work with existing OCI registries, scanners, and signing tools, while conformance suites test both Kits and runtimes.

The model gives teams a concrete way to treat agent permissions as part of the software supply chain.

Some of the highest-value agent use cases sit on mainframes where moving production data may be restricted by policy, contract, or regulation. That changes the architecture: instead of sending records to the model, teams can move reasoning toward the system of record.

• An on-prem harness translates model plans into explicit, authorized operations against DB2, IMS, CICS, VSAM, or other mainframe-native resources.
• Live reads avoid stale replicas and extra persistent copies, but introduce latency, rate-limiting, and production-load tradeoffs.
• The harness can join model traces with host-side audit records, capturing who requested what, which tools ran, and what data crossed the boundary.

For constrained environments, agent design depends on explicit capabilities, host-native authorization, and traceability across the data boundary.

Coding agents get much better when the environment around them is predictable, inspectable, and designed for both humans and automation. Unix tools provide the mechanics, while files such as AGENTS.md and reusable skills tell agents where to work, what to preserve, and how to check themselves.

• Text files, exit codes, structured output, and composable CLI tools give agents reliable building blocks without custom integrations.
• Project instructions can separate durable source files from generated or deployed copies, preventing changes that disappear later.
• Validation commands, typed CLIs, and Git-based review keep agent work testable and explainable.

The strongest agent workflows come from improving the shared environment, instructions, and checks rather than relying on model capability alone.