# AI Agents Are About to Get Real, Here's Why It Matters

Sam Partee, Arcade AI | MLOps Community | 13:20
Hosted by Demetrios Brinkmann

Source: https://www.youtube.com/watch?v=FzDDwEkSrZE
Channel: MLOps Community, now AAIF Live (https://www.youtube.com/@AAIFLive-x1r). Summarised by MLOps Talks.
Page: https://mlopstalks.com/talks/ai-agents-are-about-to-get-real-heres-why-it-matters
Published: 2025-11-21
Tags: mcp, security, structured-outputs, tool-use

## TL;DR
- AI agents need user-scoped authorization and runtime token handling before they can safely take actions in external systems.
- Arcade places middleware between agents and services such as Slack, GitHub, and Reddit, handling scoped tokens, secrets, refreshes, and execution.
- Tool developers can package and deploy actions as MCP servers, while MCP Gateway combines many servers behind one managed endpoint.

## Summary
Sam Partee argues that agent development has moved from collecting context to taking actions in external systems. Function calling and structured outputs made tool use easier, while Model Context Protocol helped agents connect to outside services. The harder problem is authorization. An agent needs the right user token, with permissions limited to the specific action, and those credentials must be passed, refreshed, and stored safely at runtime. Arcade provides middleware for this work. Developers decorate tools with authentication, authorization, secrets, and metadata, while Arcade manages the operational details. Partee also demonstrates a development flow for writing and deploying tools, including local clients and HTTP servers. He recommends least-privilege scopes, avoiding token logs, handling errors, and retaining user IDs for correlation. The talk ends with MCP Gateway, which lets companies combine multiple MCP servers behind one URL and manage them through shared project and tenant settings.

## Key ideas
### Agent development moved from prompt management toward function calls and external actions
[01:43](https://www.youtube.com/watch?v=FzDDwEkSrZE&t=103s)
Partee places the agent boom around 2023, when developers built systems for moving text into and out of language models. Function-calling APIs, JSON mode, and structured outputs made it easier for models to produce usable calls. He says many early tools in systems such as CrewAI and LangChain mainly searched the web or queried vector databases to gather context. Model Context Protocol continued that pattern by helping agents get context from outside systems, while action execution and resource mutation needed additional work.

### MCP connections do not solve execution, user authorization, or scaling by themselves
[02:59](https://www.youtube.com/watch?v=FzDDwEkSrZE&t=179s)
Partee describes MCP as a way for an agent to call something outside itself, while pointing out that the protocol does not itself execute the tool. Earlier designs also left user authorization unresolved and often ran tools inside the agent's client application. That tied expensive tool workloads to the client's compute environment. Browser-based tools became common because agents were already near browsers, even when that was an easy implementation choice rather than the best architecture.

### External actions require narrowly scoped credentials that follow the request to runtime
[04:40](https://www.youtube.com/watch?v=FzDDwEkSrZE&t=280s)
The difficult implementation work is moving a user's token from a browser to the place where a tool executes. Partee says the token must be scoped to the individual action and must avoid giving an agent broad privileges such as deleting a user's Git or Google Drive data. He describes a GitHub token being passed through context and remaining usable through a refresh. Practices like this can prevent an enterprise from deploying an agent.

### Arcade handles authorization and secrets between agents and external services
[05:33](https://www.youtube.com/watch?v=FzDDwEkSrZE&t=333s)
Arcade sits between an agent and services such as Slack, GitHub, or an organization's own protected services. Developers decorate each tool with the OAuth, authorization, secrets, and metadata needed for that action. For a service such as Reddit, a read action and a write action receive different scopes. Arcade maintains the token at runtime, refreshes it, and supplies it to the tool. Secrets such as database or Salesforce URLs can be assigned at the project, tenant, customer, or user level.

### Scoped actions allow agents to run in the background after a user grants permission
[07:56](https://www.youtube.com/watch?v=FzDDwEkSrZE&t=476s)
Once tools represent real actions rather than simple searches, an agent can run outside the user's active session. Partee describes scheduled executions and cron jobs that refresh a token and perform actions the user has already permitted. He also says developers can use Arcade with Cursor, Claude, or the command line. A developer can write one Python tool, run a configuration command, and use that tool from a supported client.

### Tool packaging should include structure, versioning, metadata, and deployment
[08:56](https://www.youtube.com/watch?v=FzDDwEkSrZE&t=536s)
Partee presents a quick start for creating MCP servers and compares it with the experience of using Rust's cargo new. The approach avoids putting an entire server into one large TypeScript file with tokens stored in environment variables. A tool can run over standard input and output with local clients or as an HTTPS streamable server. Arcade's deployment flow packages the function with product structure, versioning, and metadata.

### Least-privilege scopes and careful credential handling remain developer responsibilities
[11:04](https://www.youtube.com/watch?v=FzDDwEkSrZE&t=664s)
Partee recommends choosing a read scope for reading email and a write scope for writing it instead of requesting maximum permissions. He tells developers not to log tokens and says user IDs help connect a person to the tool they ran. He also mentions error handling as an important part of tool development. These practices apply even when agents are involved and teams are tempted to accept weaker security standards.

### MCP Gateway combines many servers behind one managed endpoint
[12:30](https://www.youtube.com/watch?v=FzDDwEkSrZE&t=750s)
For companies with many MCP servers, Partee introduces MCP Gateway. It connects the servers to one URL and exposes them through an HTTPS streamable interface. The servers can then be managed in one place with the same project, tenant, and token model used elsewhere in Arcade. He also mentions a community marketplace as another planned part of the product.

## Notable quotes
- Sam Partee: "It's a lot of code and like here's how you can do this in Arcade, have an agent actually take an action on your behalf as the user and do so securely." (01:03)
- Sam Partee: "How do I get the user token from something like a browser and pass it all the way to the point where my tool's executing?" (04:40)
- Sam Partee: "Please do not just give the max scopes." (11:04)
- Sam Partee: "Don't log your tokens. Please stop doing that. I can still log in as you today." (11:26)

## Tools & references mentioned
- Arcade
- Arcade AI
- Demetrios Brinkmann
- Claude
- CrewAI
- LangChain
- Model Context Protocol
- MCP
- GitHub
- Google Drive
- Slack
- Reddit
- Cursor
- Rust
- MCP Gateway

## Who should watch
- You are building an agent that needs to read from or write to services on behalf of individual users, and you need a practical authorization model.
- Your tools currently run inside a client application or browser because that is where the agent lives, and you want to separate tool execution from the client.
- You manage multiple MCP servers and need shared token, tenant, and project settings behind one endpoint.

## Related talks

- [MCP is not going to change everything (yet)](https://mlopstalks.com/talks/mcp-is-not-going-to-change-everything-yet) (Sam Partee, Arcade AI & Rahul Parundekar, AI Hero, 1:04:43)
- [Responsible Autonomy: Building Governance Frameworks for AI That Act in the Real World via MCP](https://mlopstalks.com/talks/responsible-autonomy-building-governance-frameworks-for-ai-that-act-in-the-real) (Saurabh Mishra, Optum, 27:55)
- [MCP Security: What Happens When Your Agents Talk to Everything?](https://mlopstalks.com/talks/mcp-security-what-happens-when-your-agents-talk-to-everything) (, 24:26)
- [Enterprise-ready MCP](https://mlopstalks.com/talks/enterprise-ready-mcp) (Jiquan Ngiam, MintMCP, 28:36)
- [Governance for AI Agent Deployment](https://mlopstalks.com/talks/governance-for-ai-agent-deployment) (Spencer Reagan, Airia, 54:18)