MCP, Tools, and Orchestration

Tool use: the atom

At the bottom of everything is tool use, also called function calling. The developer describes a tool to the model — a name, a description, and a JSON schema for its inputs — and the model, when it decides the tool is needed, emits a structured call that the surrounding code executes. “Run this SQL,” “search these docs,” “send this message” are all tool calls. Everything above is a way of organizing tool calls at scale.

MCP: the USB-C moment

The problem with tool use was that every assistant needed a custom connector for every system — an N×M explosion of bespoke integrations. Anthropic's Model Context Protocol (MCP), open-sourced in November 2024, standardized that connection. Its own documentation offers the analogy that stuck: MCP is “a USB-C port for AI applications” — build a tool once, and any MCP-speaking client can use it.¹²

What turned a single vendor's proposal into infrastructure was adoption. OpenAI embraced MCP in March 2025 — Sam Altman wrote, “People love MCP and we are excited to add support across our products”³ — followed by Google and Microsoft. By its first anniversary the MCP registry held close to 2,000 servers, with adopters spanning GitHub, OpenAI, Microsoft, AWS, and Google Cloud,⁴ and Google had begun shipping fully managed remote MCP servers for BigQuery and other services.⁵ A standard that every major lab supports is no longer a bet; it is a foundation.

Above the wire: A2A and orchestration

If MCP is how an agent reaches tools and data, the Agent2Agent (A2A) protocol is how agents reach each other: a standard, contributed to the Linux Foundation in June 2025 with more than a hundred supporting companies, that lets independent agents from different vendors discover one another and delegate work.⁶ Above the protocols sit orchestration frameworks that sequence multi-step, multi-agent work — LangGraph, OpenAI's Agents SDK (launched March 2025 with tools, handoffs, guardrails, and tracing), Google's Agent Development Kit, Microsoft's Agent Framework, and CrewAI among them.^7981110

Durable execution: why agents need it

Agent runs are long, branchy, and failure-prone: a model can be probabilistic, a tool can time out, a human approval can take a day. Ordinary retry logic does not survive that. Durable-execution engines — Temporal, Inngest, Restate, Vercel's Workflow Development Kit — solve it by persisting workflow state at every step and replaying after a crash, so a multi-day agentic pipeline resumes exactly where it stopped. The market is voting with capital: Temporal raised a $300 million round at a $5 billion valuation in early 2026, explicitly to “make agentic AI real for companies,” with OpenAI and Block among its named customers.¹² Durable execution is becoming table stakes for any agent that touches production.

The catch: every tool is an attack surface

The same property that makes MCP powerful — agents can be handed new tools freely — makes it dangerous. A tool's description is text the model trusts, which means it is a place to hide malicious instructions; an over-permissioned agent connected to private data and the open internet is a breach waiting to happen.¹³ The plumbing chapter ends where the next one begins: connectivity without governance is a liability, not a feature.