Agent Frameworks

The whole idea, without a framework:

def agent(task: str, tools: dict, max_steps: int = 20) -> str:
    messages = [{"role": "user", "content": task}]

    for _ in range(max_steps):
        reply = model.chat(messages, tools=[schema(t) for t in tools.values()])
        messages.append(reply)

        if not reply.tool_calls:
            return reply.content

        for call in reply.tool_calls:
            # Everything returned here is untrusted input, whatever it says.
            result = tools[call.name](**call.arguments)
            messages.append({"role": "tool", "tool_call_id": call.id,
                             "content": str(result)})

    return "step limit reached"

That is ReAct, and it is a complete agent. Anything a framework offers is on top of it.

What the frameworks add

State and persistence. The loop above loses everything if the process dies. LangGraph checkpoints state per step, so a run resumes, and can be rewound to a prior step and continued differently.

Human-in-the-loop. Pausing before a consequential action and waiting for approval requires the loop to be interruptible and resumable — which is the same machinery as persistence, and the main reason to want it.

Observability. Which tools were called, with what, how many tokens, where the time went. Debugging an agent without a trace view is guesswork, and this is where most of the practical value is.

Multi-agent structure. Several models with different prompts and tools, passing work between them. AutoGen and CrewAI are organised around this; the evidence that it beats one well-prompted model with all the tools is weaker than the enthusiasm suggests.

The hard parts, which no framework solves

Knowing when to stop. Agents loop, repeat failed actions, and declare success on incomplete work. The step limit above is a blunt instrument and it is what most production systems actually rely on.

Error recovery. A tool returns an error; the model tries the same call again. Making failure informative — a message that says what to do differently — matters more than any orchestration feature.

Context growth. Every step appends. A twenty-step run overflows the window, and what to summarise or drop is application-specific.

Prompt injection. A retrieved document or tool output containing instructions is indistinguishable, to the model, from instructions you sent. Give an agent both a browser and a shell and this stops being theoretical. No framework fixes it, and the mitigations that work are architectural: least privilege per tool, approval gates on anything with an effect, and never routing untrusted content into a step that can act.

The last row is orthogonal to the others: MCP is how tools are exposed, and every framework above can consume them.