Agentic AI & MCP Engineering Roadmap

Separate useful model reasoning from policy, state, and software guarantees. Start simple, then earn complexity through evaluation.

• Distinguish fixed automation, model-assisted tasks, one agent, and multi-agent workflows
• Choose deterministic code for stable rules and consequential enforcement
• Define an agent as a model with instructions, tools, state, and a bounded goal
• Compare a simple baseline before adding planners, critics, routers, or specialists
• Use typed state and minimal context at every handoff
• Define ownership, success, failure, cancellation, waiting, and escalation states
• Bound steps, elapsed time, tokens, tool calls, retries, concurrency, and cost
• Use durable workflow state rather than asking the model to remember transactions
• Apply idempotency keys at side-effect boundaries
• Version agents, models, instructions, tools, policies, and workflow definitions

Build one local read-only server from the official specification before using remote authorization or consequential tools.

• Explain hosts, clients, servers, connection isolation, and JSON-RPC messaging
• Follow initialization, protocol-version selection, capability negotiation, operation, and shutdown
• Distinguish model-controlled tools, application-controlled resources, and user-controlled prompts
• Design narrow input and output schemas with stable semantics and actionable errors
• Use URI schemes and resource templates without exposing arbitrary paths
• Implement progress, cancellation, pagination, subscriptions, or logging only when negotiated
• Use stdio for a client-launched local server and keep diagnostics off stdout
• Secure Streamable HTTP with origin checks, safe binding, TLS, sessions, and authentication
• Test malformed messages, unsupported methods, timeouts, oversized results, and cancellation
• Review server source, package provenance, dependencies, configuration, and enabled tools

Context is a selected working set. Keep authoritative state and durable records outside the model and treat every external source as untrusted.

• Budget instructions, recent turns, structured state, retrieved chunks, tool results, and output
• Remove redundant history and test summarization for important information loss
• Separate ephemeral task state from governed durable memory
• Require purpose, access, correction, retention, and deletion for persistent memory
• Govern source ownership, approval, version, effective date, parsing, chunking, and metadata
• Filter and rank evidence by relevance, authority, freshness, tenant, and resource scope
• Preserve source IDs and support citations that users can inspect
• Abstain or escalate when evidence is missing, weak, stale, or conflicting
• Evaluate retrieval recall and ranking separately from final-answer support
• Defend against context poisoning and indirect prompt injection in documents and tool output

The model can propose an action; only trusted identity, policy, validation, and approval controls can authorize and execute it.

• Threat-model assets, actors, trust boundaries, prompt injection, confused deputies, and exfiltration
• Use OAuth and audience-bound tokens for protected remote MCP servers
• Avoid token passthrough and separate downstream API authorization
• Limit identities, tenants, resources, verbs, tools, destinations, fields, and network reach
• Keep credentials and policy outside prompts, resources, tool results, and logs
• Validate every model-proposed argument and every tool result in trusted code
• Allowlist destinations and use egress controls for remote access
• Apply layered OWASP-aligned defenses against prompt injection and excessive agency
• Show exact action, destination, evidence, consequences, and content for human approval
• Bind approval to identity, content hash, destination, policy version, and expiration

Release agent workflows as versioned systems with measurable gates, privacy-aware traces, hard budgets, kill switches, and practiced rollback.

• Version representative normal, ambiguous, unsupported, failure, and adversarial cases
• Measure task success, evidence support, tool choice, arguments, handoffs, refusal, and approval
• Compare deterministic, single-agent, and multi-agent baselines
• Break out security, fairness, accessibility, robustness, latency, reliability, and cost
• Trace orchestration, model, retrieval, MCP, policy, approval, and execution spans
• Redact telemetry, restrict access, sample deliberately, and expire content
• Retry only transient faults with backoff, jitter, cancellation, and bounded attempts
• Alert on loops, authorization denials, approval bypass attempts, drift, latency, and budget breach
• Use shadow or canary evaluation, a kill switch, version pinning, and tested rollback
• Complete both projects, publish sanitized evidence, and verify cleanup and billing