Making (and Breaking) Agents
by Adding 1,000 MCP Tools

Quick context

• 200+ connectors, 11,000+ actions, all accessible via MCP
• We've learned what breaks when you scale this up

Today: I'll build an agent, give it 1,000 tools, and show you what breaks.

Why would you even want 1,000 tools?

The question isn't whether agents will have hundreds of tools.
It's what breaks when they do.

The demo setup

Real MCP connections · Anthropic API via Anthropic Agent SDK

import { Client } from "@modelcontextprotocol/sdk/client";
import { StreamableHTTPClientTransport }
  from "@modelcontextprotocol/sdk/client/streamableHttp";

// Connect to StackOne MCP server
const client = new Client({
  name: "mcp-agent", version: "1.0.0"
});

const transport = new StreamableHTTPClientTransport(
  new URL("https://api.stackone.com/mcp"),
  { requestInit: { headers: {
      Authorization: `Basic ${authToken}`,
      "x-account-id": accountId
  }}}
);

await client.connect(transport);
const tools = await client.listTools();

import Anthropic from "@anthropic-ai/sdk";

// Intentionally manual (not using SDK's native MCP support)
// so we can show what breaks when all tools land in context
const response = await anthropic.messages.create({
  model: "claude-haiku-4-5-20251001",
  max_tokens: 1024,
  tools,  // all MCP tools passed here
  messages: [{ role: "user", content: prompt }]
});

for (const block of response.content) {
  if (block.type === "tool_use") {
    // Execute via MCP client
    const result = await client.callTool({
      name: block.name,
      arguments: block.input
    });
  }
}

Start small: personal assistant

❯ /add Gmail

✓ Gmail (+42 tools)

❯ /add Trello

✓ Trello (+109 tools)

❯ /add Gong

✓ Gong (+16 tools)

📊 MCP DEMO DASHBOARD

Tools: 167

Tokens: ~25,000

Accounts: 3

Gmail(42), Trello(109), Gong(16)

It works great

Claude picks the right tool, executes via MCP, returns real data.

Now add more...

❯ /add HubSpot

✓ HubSpot (+65 tools)

❯ /add Ashby

✓ Ashby (+108 tools)

❯ /add GitHub

✓ GitHub (+74 tools)

❯ /add Jira

✓ Jira (+158 tools)

❯ /add Zendesk

✓ Zendesk (+45 tools)

... + Notion, Datadog, Google Drive, and more

📊 MCP DEMO DASHBOARD

Tools: 916

Tokens: ~137,550

Accounts: 20

🚨 CRITICAL: 69% of context consumed before the first question

tools from 20 providers + agent defaults

Agent defaults (web, files) plus each provider adding dozens to hundreds of MCP tools.
This is what a real-world, general-purpose agent looks like.

The problem

Context Explosion

Two forces fill the context window:

The research confirms it

The fix

Tool Search / Discovery

Don't load 916 tool definitions upfront. Give the agent 2 discovery tools to find what it needs.

276x context reduction — "list CRM contacts" → finds hubspot_list_contacts, agent picks one and executes

Ranking strategies

How do you match "create a jira ticket" to the right MCP tool out of 845? Accuracy ranges based on MCP tool routing.

Hybrid: better accuracy, zero API calls, no embedding infra.
Formula: score = 0.2 × BM25 + 0.8 × TF-IDF  —  our implementation ↗

Problem #2

Response Bloat

Discovery fixed the upfront cost. But every tool call still dumps raw API responses into the conversation.

A few multi-tool turns and you've burned 100k+ tokens on data the model mostly ignores.

The fix

Code Mode (Sandboxed Execution)

Pioneered by Cloudflare, validated by Anthropic's Code Execution with MCP research: "Reduce token usage from ~150k to ~2k tokens — a 98.7% saving."

How Code Mode works

Code Mode in practice

3 providers, 124 records fetched, ~55k tokens of raw JSON — but only a 9-line summary reached the LLM context.

The problem

Indirect Prompt Injection

The danger isn't just malicious tools.
It's legitimate tools reading untrusted data.

Emails, CRM records enriched from scraped data, web search results, call transcripts...
Any system that accepts external input is an attack surface.

How indirect injection works

A real attack

The tool is legitimate. The content is malicious.

Indirect injection in action

This is why your security team says no.

OWASP's #1 threat for LLMs

The fix

Content Sanitization

Scan every MCP tool response before it reaches the agent. Strip injection attempts from content.

Defense powered by @stackone/prompt-defense (private beta)

Same attack, with defense

An efficient answer for the problem at hand.

Problem → Fix

Not exhaustive. These build on each other, and complement:

MCP is the protocol.

Protocols don't solve what happens when you connect hundreds of tools.

You need infrastructure that handles context, routing, and safety.

Thank you

What you saw today

Guillaume Lebedel · guillaume@stackone.com