Connect an agent to a read-only internal tool

A read-only tool is a useful first integration because it tests schema, identity, authorization and output validation without permitting state changes.

Restrict the catalogue

The integration lab enables only get_order.

from integration_cases import read_only_tool_case

result = read_only_tool_case()
assert result["enabled"] == ["get_order"]
assert result["call_valid"] is True
assert result["write_tool_enabled"] is False
assert result["agent_executed"] is False

Define a narrow input schema and stable response/error contract. Authenticate the user, derive tenant and check scope before reading. Validate tool output before it enters model context. Apply timeouts, pagination, rate limits and metadata-only audits.

The prompt cannot grant authority. Retrieved content and tool output remain untrusted data. Test cross-tenant IDs, injected instructions, schema drift and provider outage. Keep write capability in a separate reviewed design.

The FDE for Freshers course builds toward MCP and agent systems after safe API foundations.

Exercise

Wrap a local order repository in one typed read tool. Prove unauthorized tenant access fails before lookup and no write function is discoverable.

Continue learning

This article is part of the FDE integration and deployment foundations sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Build a small retrieval service with cited results.
• Continue with Write a deployment rollback procedure.

Reference: MCP security best practices.