AI agents need user-scoped authorization and runtime token handling before they can safely take actions in external systems.
2
Arcade places middleware between agents and services such as Slack, GitHub, and Reddit, handling scoped tokens, secrets, refreshes, and execution.
3
Tool developers can package and deploy actions as MCP servers, while MCP Gateway combines many servers behind one managed endpoint.
Summary
Sam Partee argues that agent development has moved from collecting context to taking actions in external systems. Function calling and structured outputs made tool use easier, while Model Context Protocol helped agents connect to outside services. The harder problem is authorization. An agent needs the right user token, with permissions limited to the specific action, and those credentials must be passed, refreshed, and stored safely at runtime. Arcade provides middleware for this work. Developers decorate tools with authentication, authorization, secrets, and metadata, while Arcade manages the operational details. Partee also demonstrates a development flow for writing and deploying tools, including local clients and HTTP servers. He recommends least-privilege scopes, avoiding token logs, handling errors, and retaining user IDs for correlation. The talk ends with MCP Gateway, which lets companies combine multiple MCP servers behind one URL and manage them through shared project and tenant settings.
Agent development moved from prompt management toward function calls and external actions
Partee places the agent boom around 2023, when developers built systems for moving text into and out of language models. Function-calling APIs, JSON mode, and structured outputs made it easier for models to produce usable calls. He says many early tools in systems such as CrewAI and LangChain mainly searched the web or queried vector databases to gather context. Model Context Protocol continued that pattern by helping agents get context from outside systems, while action execution and resource mutation needed additional work.
MCP connections do not solve execution, user authorization, or scaling by themselves
Partee describes MCP as a way for an agent to call something outside itself, while pointing out that the protocol does not itself execute the tool. Earlier designs also left user authorization unresolved and often ran tools inside the agent's client application. That tied expensive tool workloads to the client's compute environment. Browser-based tools became common because agents were already near browsers, even when that was an easy implementation choice rather than the best architecture.
External actions require narrowly scoped credentials that follow the request to runtime
The difficult implementation work is moving a user's token from a browser to the place where a tool executes. Partee says the token must be scoped to the individual action and must avoid giving an agent broad privileges such as deleting a user's Git or Google Drive data. He describes a GitHub token being passed through context and remaining usable through a refresh. Practices like this can prevent an enterprise from deploying an agent.
Arcade handles authorization and secrets between agents and external services
Arcade sits between an agent and services such as Slack, GitHub, or an organization's own protected services. Developers decorate each tool with the OAuth, authorization, secrets, and metadata needed for that action. For a service such as Reddit, a read action and a write action receive different scopes. Arcade maintains the token at runtime, refreshes it, and supplies it to the tool. Secrets such as database or Salesforce URLs can be assigned at the project, tenant, customer, or user level.
Scoped actions allow agents to run in the background after a user grants permission
Once tools represent real actions rather than simple searches, an agent can run outside the user's active session. Partee describes scheduled executions and cron jobs that refresh a token and perform actions the user has already permitted. He also says developers can use Arcade with Cursor, Claude, or the command line. A developer can write one Python tool, run a configuration command, and use that tool from a supported client.
Tool packaging should include structure, versioning, metadata, and deployment
Partee presents a quick start for creating MCP servers and compares it with the experience of using Rust's cargo new. The approach avoids putting an entire server into one large TypeScript file with tokens stored in environment variables. A tool can run over standard input and output with local clients or as an HTTPS streamable server. Arcade's deployment flow packages the function with product structure, versioning, and metadata.
Least-privilege scopes and careful credential handling remain developer responsibilities
Partee recommends choosing a read scope for reading email and a write scope for writing it instead of requesting maximum permissions. He tells developers not to log tokens and says user IDs help connect a person to the tool they ran. He also mentions error handling as an important part of tool development. These practices apply even when agents are involved and teams are tempted to accept weaker security standards.
MCP Gateway combines many servers behind one managed endpoint
For companies with many MCP servers, Partee introduces MCP Gateway. It connects the servers to one URL and exposes them through an HTTPS streamable interface. The servers can then be managed in one place with the same project, tenant, and token model used elsewhere in Arcade. He also mentions a community marketplace as another planned part of the product.
"It's a lot of code and like here's how you can do this in Arcade, have an agent actually take an action on your behalf as the user and do so securely."Sam Partee01:03
Who should watch
You are building an agent that needs to read from or write to services on behalf of individual users, and you need a practical authorization model.
Your tools currently run inside a client application or browser because that is where the agent lives, and you want to separate tool execution from the client.
You manage multiple MCP servers and need shared token, tenant, and project settings behind one endpoint.
