The hype cycle is predictable. ChatGPT ships → everyone wants an "AI agent" → startups pitch AI handling your sales calls, writing your code, running your company. Some of that will happen. Most of it won't. The agents that *do* ship are boring. They're narrow. They have hard guardrails. A code-review bot that flags TODOs and security patterns. A moderation queue that buckets support tickets. An email summarizer that extracts action items. Not sexy. Very useful. The sexy vision — an autonomous agent reasoning through your entire codebase and shipping pull requests — is technically possible today. It's also a nightmare. Hallucinations at scale, permission scope creep, audit trails that collapse, a deleted production table because the agent "optimized the schema." The pattern that actually works: Claude + tool use + scoped MCP servers + human approval for high-stakes decisions. You keep the loop human. The agent handles the tedium. Here's how Aidxn thinks about agents in production.
Agent vs. Prompt-and-Pray
Lots of "agentic AI" is just prompt-and-pray with extra steps. You give Claude a task, it returns a response, you use it. That's not an agent — that's a chatbot. An agent is different: it's a system that perceives the environment, takes actions toward a goal, and iterates. It has memory. It calls tools. It reasons about failures and retries. It knows when to ask for help.
Real agents live inside a loop:
1. Receive instruction + context
2. Reason: "What tools do I need?"
3. Call tools (code, fetch data, search, etc.)
4. Observe: "Did it work?"
5. Iterate or hand off to humanThat loop repeats until the task is done or the agent hits a guardrail. The magic is step 2 — the agent doesn't just follow instructions blindly. It *decides* what to do. That decision-making is where agents become useful (and where they get dangerous). A well-scoped agent in a narrow domain — "index all blog posts into a search vector DB" — is powerful. The same agent given access to "the entire Supabase schema and write permissions" is a liability waiting to happen.
Four Real Production Agents (Aidxn Pattern)
1. Code Review Bot
PR lands on GitHub → webhook fires → Claude reads the diff → checks for security patterns (SQL injection vectors, hardcoded secrets, missing validation), flagged TODOs, architectural inconsistencies. Returns inline comments. No merging. No auto-fixes. Just: "Line 42: this query is vulnerable to injection. See the pattern at [link]." Human reviews, ships, or iterates. The agent surfaces risk. Humans decide.
const reviewPr = async (owner, repo, prNumber) => {
const diff = await github.getPullDiff(owner, repo, prNumber);
const review = await anthropic.messages.create({
model: 'claude-3-5-sonnet-20241022',
max_tokens: 2048,
system: 'You are a code reviewer. Flag security, performance, and consistency issues.',
messages: [{
role: 'user',
content: `Review this diff for issues:\n\n${diff}`
}]
});
// Post comments on the PR
const issues = parseReview(review.content[0].text);
for (const issue of issues) {
await github.postComment(owner, repo, prNumber, issue);
}
};2. Email Summarizer
Your inbox is chaos. 200 emails a day. You miss critical asks buried in threads. An agent reads your recent email, extracts action items, groups by sender/priority, and posts a summary to Slack each morning. Five lines. "Alice: fix the font weight in the header. Bob: approve the Supabase schema change. Carol: respond to the customer about payment terms." You reply in Slack, the agent logs it. No overengineering — just reduction.
const summarizeEmail = async (emails) => {
const summary = await anthropic.messages.create({
model: 'claude-3-5-sonnet-20241022',
max_tokens: 500,
system: 'Extract action items. Format: Sender: action. One line per item.',
messages: [{
role: 'user',
content: `Emails:\n\n${emails.map(e => `From: ${e.from}\n${e.body}`).join('\n\n---\n\n')}`
}]
});
await slack.postMessage(channel, summary.content[0].text);
};3. Support Ticket Triage
New ticket lands → agent reads it → classifies as "bug," "feature request," "billing," "lost password" → assigns to the right queue. Pulls docs to suggest a self-serve answer. Customer sees: "We found 3 help articles for password reset — try here first." If they still need help, ticket routes to support with context pre-filled. 60% of tickets resolve without human touch. The 40% that don't are pre-summarized.
4. Content Moderation Queue
User submits a comment → agent classifies: "OK," "needs review," "likely spam," "hate speech." Low-confidence calls go to a human review queue with the agent's reasoning visible. High-confidence OK comments auto-publish. The agent learns from human feedback (if you wire a feedback loop). Spam drops 90%. Human reviewers now handle edge cases, not the 80% of obvious stuff.
Safety Patterns: Scope, Gate, Audit
Each agent above has three properties:
Scope. The code-review bot can only post comments — it can't merge or push. The email summarizer can only read, not send. The ticket agent can only classify and suggest — it routes to humans for assignment. Each agent's tool access is minimal for its job. No agent has write access to production. No agent can delete anything. If it can cause harm in 30 seconds with a bug, it doesn't have that permission.
Gate. High-stakes decisions require human approval. Auto-route is OK. Auto-publish spam comments? No. Auto-deploy code? Absolutely not. Every agent has a decision point where it halts and says "human, your call." You decide what that threshold is. For moderation: "50% confidence → human review." For email: "customer billing question → always flag to ops."
Audit. Every agent call is logged. Input, output, decision, action. If something goes wrong, you trace it. "The agent classified that ticket wrong — let me see the input and the reasoning." Audit logs let you debug and retrain. They're also your paper trail for compliance. Store in Supabase or Cloud Logging, queryable by time, agent, user.
const auditLog = async (agentName, input, output, action) => {
await supabase.from('audit_logs').insert({
agent: agentName,
input,
output,
action,
timestamp: new Date(),
user_id: context.user.id,
});
};Building with Claude SDK + MCP
The pattern: Claude + tool use + custom MCP servers. MCP (Model Context Protocol) is Anthropic's standard for connecting Claude to tools and data sources. You write MCP servers that expose: "I can read GitHub diffs. I can fetch emails. I can post to Slack. I can query your Postgres database." Claude sees those capabilities and uses them autonomously within a loop.
// MCP Server: GitHub diffs
export const githubMcp = {
getPullDiff: async (owner, repo, pr) => {
const { data } = await octokit.pulls.get({ owner, repo, pull_number: pr });
return data;
},
};
// Agent loop
const agent = async (instruction) => {
const tools = [
{ name: 'get_diff', fn: githubMcp.getPullDiff },
{ name: 'post_comment', fn: github.postComment },
{ name: 'slack_notify', fn: slack.sendMessage },
];
let response = await anthropic.messages.create({
model: 'claude-3-5-sonnet-20241022',
max_tokens: 4096,
tools,
system: 'You are a code review agent. Review the PR. Post comments.',
messages: [{ role: 'user', content: instruction }],
});
// Agentic loop: while agent wants to call tools, call them
while (response.stop_reason === 'tool_use') {
const toolUse = response.content.find(b => b.type === 'tool_use');
const result = await tools.find(t => t.name === toolUse.name).fn(...toolUse.input);
response = await anthropic.messages.create({
model: 'claude-3-5-sonnet-20241022',
max_tokens: 4096,
tools,
system: '...',
messages: [
...response.messages,
{ role: 'assistant', content: response.content },
{ role: 'user', content: `Tool result: ${JSON.stringify(result)}` },
],
});
}
return response.content[0].text;
};The loop continues until Claude finishes (stop_reason === 'end_turn') or hits an error. That's the agent pattern.
Six FAQs
Will agents replace developers?
Not in 2026–2027. Agents are useful for tedium (code review, triaging, summarizing). They fail at ambiguity (architectural decisions, user research, design trade-offs). Developers who delegate tedium to agents ship faster. Developers who expect agents to make judgment calls get burned. Agents are tools, not colleagues.
How do I prevent an agent from breaking production?
Don't give it production access. Agents should run in sandbox environments, against staging databases, with human approval before any production action. A code-review agent has read access to your repo, zero write access. A data-migration agent can preview changes (show the SQL) but needs human sign-off before executing. Gate + audit.
Can agents learn over time?
Yes, with a feedback loop. After each agent decision, collect human feedback. ("Agent classified this ticket wrong.") Store in a database. Periodically retrain the prompt with examples. "When you see X, it's actually Y." Fine-tuning is expensive; prompt-based learning is cheaper. Over months, the agent gets smarter.
How much do agents cost?
It depends on how much they call. A code-review agent on 20 PRs/day at ~$0.01 per PR: $0.20/day. An email summarizer on 50 emails/day: ~$0.05/day. A ticket agent on 100 tickets/day: ~$0.10/day. Total: ~$1.50/day for all three. For context: that's cheaper than 10 hours of developer time, and agents are 24/7. Cost is the non-issue.
Should I use an agent framework like LangChain or CrewAI?
For simple agents, the Anthropic SDK is enough. For complex multi-agent orchestration (agent A talks to agent B, they coordinate), frameworks help. But they add abstraction and latency. Start with Claude SDK + MCP. Only graduate to a framework when you hit coordination overhead.
What about security: can agents exfiltrate data?
Yes, if you give them access to sensitive data and a data-exfil tool (like "send email"). Restrict tool access to what's needed. If the agent doesn't need to read customer PII, don't expose that tool. Logs are queryable; if an agent behaves oddly, audit and revoke permissions. Same rules as you'd apply to a junior developer.
The Bottom Line
Agents are not the singularity. They're a productivity multiplier for boring tasks. Code review, email triage, ticket classification, moderation queues. You define the scope, set the gates, and audit the decisions. Claude + MCP + tool use is the current state of the art. Build an agent for the tedium. Keep the judgment calls human. Start with a simple one — maybe an email summarizer for yourself — and expand from there once you've built the audit loop. Ready to ship? Let's scope your first agent or read more about MCP servers and tool use patterns.