# A clean connector does not make a reliable agent

Your integration tests pass. Every tool returns what it should, schemas validate, errors are structured.

The agent still spent forty tool calls going in a circle and then confidently reported a result it had not verified.

Nothing was broken. The connector did its job perfectly. The job was just much smaller than anyone assumed.

## What the protocol owns

Discovery, invocation, schemas, transport, session lifecycle. Whether a capability exists, how it is described, and how a call is made and answered.

That is the entire list. It is a contract about plumbing, and it is a good contract.

## What the host still owns

Everything that determines whether the system behaves sensibly:

- **The goal**, and a checkable definition of what finishing means
- **Budgets**: tokens, time, money, number of tool calls
- **Stop conditions**, including the ugly ones like "the last three attempts produced the same error"
- **Approval gates** for anything expensive or irreversible
- **Policy**, meaning what this particular user is allowed to have done on their behalf

None of that belongs in the MCP server. A server enforcing per-user policy is a server that has to know about your product's permission model, which means every consumer of it inherits your assumptions.

The temptation is to push these rules into prompts, because prompts are easy to edit. A prompt that says "always ask before deleting" is a preference. Product code that refuses to delete without a confirmation is a control. Only one of them survives a model that is having a bad day.

## The test that separates the two

Ask what a passing test actually proves.

"The search tool returns results" proves the connector works. "The agent, given an ambiguous request, searched twice, found nothing conclusive, and said so instead of inventing an answer" proves the system works.

The second kind requires evaluating trajectories: what the agent did, in what order, and when it stopped. It is more work to build, and it is the only thing that tells you whether autonomy is safe here.

## Closing thought

Connector green does not mean agent ready. Those are two test suites, and most teams have written one.

*Part 4 of 5 Days of MCP for Production AI.*

If your agent went into a loop tomorrow, what would stop it, and would that thing be code or a sentence in a prompt?