The Curriculum / Reader / 07 — Agents & MCP
LEVEL 1 · ESSENTIALS · COMPANY TRACK

07 — Agents & MCP

This page compiles 3 files from the repository, verbatim, in reading order. The living version: this folder on GitHub.

level-1-essentials/company/07-agents-mcp/README.md

07 — Agents & MCP

Model Context Protocol (MCP) servers and the first agentic workflows.

Files

Rules

  1. Least privilege — read before write
  2. HITL before autonomous — earn autonomy through eval history
  3. Every agent has an eval set (25 cases minimum)
  4. Every agent has a kill switch
  5. Staged rollout — beta, pilot, department, org

level-1-essentials/company/07-agents-mcp/agent-workflow-designs.md

The Three Starter Agent Workflows

The first three agents to deploy. Each is high-ROI, bounded, and safe to start with HITL.

Agent 1 — Inbox Triage Agent

What it does

Every 2 hours during working hours, scans each employee's inbox and: - Classifies new emails (Reply-today, Reply-this-week, FYI, Newsletter, Trash) - Drafts responses for the Reply-today items (using the email-reply-drafter prompt) - Files newsletters and archives obvious noise - Posts a summary to Slack DM: "3 replies ready, 8 FYIs, 22 archived"

Autonomy level

Suggest + partial execute. Drafts saved, obvious trash archived, but nothing sent.

Tools required

Guardrails

Eval set

5 good + 5 hard test cases per employee's inbox during pilot.

Rollout

Agent 2 — Meeting-Notes-to-CRM Agent

What it does

After every sales call (detected via calendar + transcription integration): - Retrieves the transcript from Otter / Fireflies / Gong - Extracts structured fields: attendees, deal stage, next step, close date, budget signals, competitors mentioned - Proposes CRM updates for the AE to approve - Drafts a follow-up email

Autonomy level

Suggest. All CRM updates and emails are drafts requiring AE approval.

Tools required

Guardrails

Eval set

20 real recorded calls with known ground truth of what should be extracted.

Rollout

Agent 3 — Weekly Report Generator

What it does

Every Friday at 3pm, generates a personalized weekly report for each employee: - Pulls from Calendar, Slack messages sent, tickets/issues closed, docs edited - Runs the weekly-review prompt (individual/04-prompt-library/19-weekly-review.md) - Sends the report to the employee's DM - Optionally rolls up to team dashboards

Autonomy level

Full auto. Report is generated and delivered without human intervention. But it's read-only — no external actions.

Tools required

Guardrails

Eval set

5 employees × 3 weeks of manual weekly reports vs generated. Compare.

Rollout

Common pattern

Notice the shape:

  1. Bounded scope — one job, well-defined
  2. HITL by default — earn autonomy
  3. Read before write — start read-only, add write behind approval
  4. Eval set before ship — 5+5 minimum, ground truth from real data
  5. Staged rollout — beta → pilot → department → org
  6. Kill switch — every agent can be paused per-user or globally

Anti-patterns

Don't build first: - Anything that sends external communications autonomously - Anything that modifies shared systems (CRM records, financials) without HITL - Anything with a false-positive cost the organization can't tolerate - "Agent that does everything" — narrow beats broad

Progression: what to build next

After the first three are stable (usually month 3–4):

Each new agent goes through the same lifecycle: brief → build → eval → beta → pilot → rollout.

level-1-essentials/company/07-agents-mcp/mcp-server-inventory.md

MCP Server Inventory

Model Context Protocol (MCP) servers expose your internal tools to AI assistants under least-privilege scopes. This inventory is what you build first.

Priority tier 1 — Universal

MCP-01 — Company Knowledge Base

MCP-02 — Calendar

MCP-03 — Email (read/draft only)

Priority tier 2 — Business systems

MCP-04 — CRM

MCP-05 — Ticketing (Jira / Linear / GitHub Issues)

MCP-06 — Data Warehouse (read-only)

MCP-07 — Documents (Drive / Notion / SharePoint)

Priority tier 3 — Advanced

MCP-08 — Support tickets (Zendesk / Intercom)

MCP-09 — Code (GitHub / GitLab)

MCP-10 — Billing / Finance systems

MCP-11 — HRIS

Server design principles

  1. Least privilege by default — read before write, drafts before send
  2. Explicit tool descriptions — the LLM must understand exactly what a tool does
  3. Structured inputs/outputs — JSON schema for every tool
  4. Idempotent where possible — tools that repeat safely reduce risk
  5. Deterministic error handling — clear error messages route back through the agent
  6. Audit logging — every tool call logged with actor, args, outcome
  7. Rate limits per user — protect from runaway agents

Deployment topology

Discovery

Testing

Before deploying an MCP server: - [ ] Tool descriptions accurate - [ ] Auth model reviewed by Security - [ ] Rate limits tested - [ ] Audit log entries verified - [ ] Adversarial-input testing (prompt injection via tool responses) - [ ] Downstream permissions honored - [ ] Rollback / kill switch confirmed

← 06 — RAG Knowledge Base 08 — Observability & Evals →