Agents, servers and the rules between them

From an answer to an action

A large language model (LLM) is trained on large amounts of text and learns patterns that let it generate responses to instructions. It can describe an analysis, summarise information or propose code. To carry out an action, an application has to connect the model to software that can execute it.

A tool-using AI agent combines an LLM with access to software tools and a goal to work towards. The model can choose a tool, read the result and use it to decide what to do next. For example, it might retrieve a dataset, run an analysis and summarise the output. The surrounding application executes the calls and controls which actions are allowed. ^3,4

This note introduces the layers that make those actions possible: software tools perform tasks, MCP connects applications to those tools, and a harness manages the work and its record. The diagrams illustrate how these components fit together in scientific software.

The gap between a tool and a method

Tool-using language-model systems connect a research question to software that can act on it. Published work such as ReAct and Toolformer explored how models can combine reasoning with tool use. ^3,4 For scientific work, the question is how these actions fit into a method that another person can inspect.

Many scientific tools are published and available independently. Their installation requirements, licences and interfaces vary. A useful workflow also needs compatible data, a defined question and a way to interpret the output.

A route is a method, and a method is not a download. Which predictor for a membrane target whose loops are disordered. What counts as a close relative worth counter-screening against, which means testing a candidate against those relatives too, to catch one that binds both.

How wide a sequence window to profile, that is how many residues either side of the site are read as one unit. How many candidates are worth making. None of that is in the tool, and all of it decides whether the campaign was worth running.

• Which version of which tool produced the shortlist.
• What the cutoff was, and whether it was the same cutoff as last time.
• Which candidates were dropped before anyone saw them, and on what grounds.
• Whether a step was rerun after a parameter changed, or the old output kept.

A reproducible campaign records those decisions whether it is run manually, through a workflow engine or with an agent. Automation helps when the record is captured consistently and can be checked by another person.

Protein design makes the problem sharper than most settings do. A single structure prediction can run for hours on a graphics card and produce files of a size nobody pastes anywhere. A backbone generator emits thousands of candidates that are meaningless until they have been scored by something else. The steps are long, the intermediates are large, and the order they run in is not obvious from the tools themselves.

The cost is also lopsided in a way that chat is not. A wrong sentence is corrected by reading it again. A wrong shortlist is corrected by a synthesis run and an assay, which is weeks and real money, and the error only becomes visible at the end. That asymmetry is why the interesting question is not how fast a pipeline runs, but how much of it can be checked first.

An MCP server makes a tool callable

The Model Context Protocol is an open standard for connecting applications to external capabilities. Servers can expose tools that perform actions, resources that supply context and prompts that provide reusable interaction templates. ¹ Standard interfaces reduce the need for a separate integration for every pairing of application and service.

It is worth being plain about what the protocol does not do. It does not decide anything. It widens what a model can reach, which is why most of the literature that followed it is about what a model should not reach, and about what happens when a tool description is itself untrusted input, which is the attack known as prompt injection. ² Reach is not judgement.

Where a server is reached from

An application can use an MCP client to communicate with a compatible server. In the protocol architecture, the host is the application the user works in, the client manages communication and the server exposes capabilities. Clients may support different features and apply different permissions; a shared protocol does not make their behaviour identical.

Our MCP server is under development and used internally. It is not currently available for customer access. The customer portal is also in development.

A harness makes a run answerable

The harness is where the judgement is constrained. The idea is older than the protocol: ReAct showed that a model does better when it alternates between reasoning and acting rather than doing either alone, ³ and Toolformer showed a model can learn when a call is worth making. ⁴ A harness is the engineering around that: the rules, the checks, the stopping points.

The record is the part we care about most, and it is the same argument as field note 3. An explanation that cannot be checked is a claim. A shortlist whose settings were never written down is a claim too.

A well-designed harness records the question, input identifiers, tool and model versions, parameters, outputs, failed steps and human decisions. This makes a run easier to inspect and reproduce. Recording these details is an implementation responsibility: MCP does not itself guarantee a complete audit trail or scientific correctness.

A harness also has to deal with the ordinary case of a step going wrong: a tool that times out, a structure that fails to download, a scorer returning zeros because its input was malformed. Hand-running hides these, because the person who hit the error fixes it and carries on.

Written down, a retry is visible. So is a result that was only obtained on the third attempt, with settings that had quietly changed between the first attempt and the third.

Approval points are defined for the project. The example here shows review when the question is agreed and before material is made; additional commitments of money or material require human approval.

What this does not fix

An agent can call a tool with an unsuitable setting, misread a result or present a weak conclusion fluently. A server provides access, the surrounding application manages execution, and procedures and review points guide the work. Their effectiveness depends on how they are implemented and used.

There is a second and less obvious failure. Because an assistant reads the descriptions of the tools it may call, those descriptions are input, and input from outside can be written to mislead. Most of the security work that followed the protocol is about exactly this: what a server may expose, and what a model may do without asking. ²

Our answer is unglamorous. The tools we expose are ones we installed ourselves, and every action that costs money or material sits behind a person. It is a smaller surface than a general assistant has, and that is deliberate.

What they change is whether being wrong is discoverable. A recorded run can be read back and the mistake found; an unrecorded one cannot. That is a weaker claim than the field usually makes, and it is the one we are willing to stand behind.

Background: milestones in scientific agents

The research brings together several strands. Coscientist and ChemCrow studied language models connected to chemistry tools and experimental systems. ^5,6 BioChatter provides a platform for biomedical applications of language models. ⁷ These studies concern particular systems and evaluated tasks; they do not establish that a general agent can conduct arbitrary research reliably.

Protein research provides further examples. ProtAgents explored collaboration between agents on protein-design tasks. ⁸ The Virtual Lab combined agents with human guidance and reported experimental tests of designed nanobodies. ⁹ These results make the connection between computational assistance and experimental evidence concrete, while leaving the scope of each study important.

Such studies demonstrate specific combinations of models, tools and human input. Their broader significance is the possibility of making parts of scientific work easier to coordinate and inspect. Their results still have to be read in the context of the task, the experimental evidence and the role of human researchers.

An inspectable record connects the original question to the inputs, software versions, settings and outputs. It also identifies failures, retries, changes to assumptions and human review decisions. Persistent identifiers or file checksums help distinguish an unchanged input from a later revision. The right level of detail depends on the work and its data-governance requirements.

References

1. Anthropic. Model Context Protocol specification. modelcontextprotocol.io (2026). modelcontextprotocol.io/specification
2. Hou X, Zhao Y, Wang S, Wang H. Model Context Protocol (MCP): landscape, security threats, and future research directions. arXiv , (2025). 10.48550/arXiv.2503.23278
3. Yao S, Zhao J, Yu D, Du N et al. ReAct: synergizing reasoning and acting in language models. International Conference on Learning Representations , (2023). 10.48550/arXiv.2210.03629
4. Schick T, Dwivedi-Yu J, Dessì R, Raileanu R et al. Toolformer: language models can teach themselves to use tools. Advances in Neural Information Processing Systems 36, 68539 (2023). 10.48550/arXiv.2302.04761
5. Boiko DA, MacKnight R, Kline B, Gomes G. Autonomous chemical research with large language models. Nature 624, 570 (2023). 10.1038/s41586-023-06792-0
6. M. Bran A, Cox S, Schilter O et al. Augmenting large language models with chemistry tools. Nature Machine Intelligence 6, 525 (2024). 10.1038/s42256-024-00832-8
7. With our advisor, Dr Sebastian LobentanzerLobentanzer S et al. A platform for the biomedical application of large language models. Nature Biotechnology 43, 166 (2025). 10.1038/s41587-024-02534-3
8. Ghafarollahi A, Buehler MJ. ProtAgents: protein discovery via large language model multi-agent collaborations. Digital Discovery 3, 1389 (2024). 10.1039/D4DD00013G
9. Swanson K, Wu W, Bulaong NL, Pak JE et al. The Virtual Lab of AI agents designs new SARS-CoV-2 nanobodies. Nature 646, 716 (2025). 10.1038/s41586-025-09442-9