If the secret lives in the process, a rotation is an outage.
The secret that sits in the agent’s environment is the outage you have not had yet. Rotate it and the process dies, or worse, keeps running on the old key until the vendor rejects it in the incident channel. Put the same secret behind a proxy the agent never sees, and a rotation is a vault write. The next call picks up the new material. The loop never notices.
That is the design decision this stack is built around. Everything else this week was the wiring.
This week we named the pieces. MCP is the connector. Composio is the catalog that keeps a thousand wrappers out of the prompt. Strands is the in-process hook that can cancel a refund after lookup and before the socket opens. Yesterday I split authentication into three problems teams keep collapsing: client to server on the MCP transport, credential brokering so a prompt-injected agent cannot walk out with a PAT, and an agent principal that can acquire a short-lived token without a human clicking Allow every ninety days. The first two have products. The third does not. This architecture leaves that blank named, and builds the rest so a rotation cannot take the agent down while it is still blank.
The requirement that defines this class is not “the agent can call tools.” Any tutorial can do that. The requirement is that the agent can discover a tool it did not ship with, invoke it without holding the credential, survive the credential changing under it, and leave a trace an engineer can replay. If you also need a record a regulator will accept, you are still in the July 27 gap. Phoenix and Langfuse will not close it. I am not going to smuggle an audit trail into a middleware diagram and call it solved.
Discovery is the layer that is, for the first time, a solved class of problem. The Model Context Protocol is the port. The official Python SDK is at 2.1.1, released August 25. The community registry sits at 7,191, last push August 22. A server advertises a name, a description, and an input schema. A client discovers it. After the July 28 spec, a single HTTP request can call a single tool with no session to babysit. That is the connector. It is not the catalog.
The catalog is what keeps discovery from eating the context window. ComposioHQ/composio is at 29,879 stars this morning, MIT. The Python package is composio 0.20.0, uploaded August 18. TypeScript is @composio/core 0.17.0, same day. You create a session scoped to a user_id from your own database. The model gets seven meta-tools. It searches, fetches schemas for the slugs it needs, and executes. It does not receive a thousand function definitions on turn one. If you only have five first-party tools, you do not need this. Write five MCP servers and register them in the runtime. The catalog earns its keep on the long tail of SaaS: Gmail, Jira, the payer portal, the CRM you will not wrap yourself. The runtime calls tools. It does not contain them.
Authentication is where the outage lives. Treat it as three layers because collapsing them is how the incident starts.
Client-to-server belongs on the MCP transport. OAuth 2.1, Protected Resource Metadata, resource indicators, short-lived tokens. Refuse servers that skip it. Strands 1.53.0 shipped client OAuth on streamable HTTP on August 21. The harness-sdk monorepo is at 7,009 stars, with Python strands-agents 1.53.0 and TypeScript @strands-agents/sdk 1.14.0. That authenticates the MCP client to the MCP server. It does not authenticate the agent to GitHub.
Credential brokering belongs under the agent. Infisical Agent Vault is at 2,137 stars, v0.39.1 on August 4, last push August 23. It sits on the wire as a TLS-intercepting proxy, swaps a placeholder for the real key, and never lets the secret enter the agent’s context. You own the CA. You own the egress firewall. Harbor SDK is the other cut: the agent invokes an abstract tool, the connector holds the key in another process, and the agent never learns the endpoint as a network primitive. Harbor is at 384 stars. The latest tag is still v0.1.2, published June 5. Nothing has shipped since. Treat it as a pattern. Implement the pattern in a process you control, or use Agent Vault if you can live with TLS interception.
The rotation rule sits here, and it is the one I would not negotiate. The agent never holds the secret. Not in an environment variable. Not in a config file it can read. Not in a vault it can query, because a query puts the value in context, and context is the prompt-injection surface. The agent sends a request with a handle. The proxy or the connector substitutes at call time. A human rotates the key in the vault. The next outbound call uses the new material. The process does not restart. The session does not die. If your architecture requires a bounce to pick up a new PAT, you do not have agent-scale authentication. You have a cron job with extra steps.
Agent identity is the blank. Entra Agent ID covers Copilot-shaped estates. Hermes on a desktop, a Strands loop on Lambda, and a Composio session for the SaaS tail do not share a principal. Until they do, bind user-delegated SaaS to a real user_id, put a rotation alarm on the refresh token, and keep the call that is the product on a path you can refuse.
Execution is the hop after the hook. Three shapes, pick by blast radius. A local MCP server is a subprocess with the permissions of whatever started it. That is fine for a desktop agent reading your notes. It is not fine for a refund tool pointed at production. AWS Lambda, or an equivalent isolated function, is the shape I want for anything irreversible: one credential, one role, one timeout, no filesystem. A direct API call from inside the loop is the fastest path and the one I would reserve for reads you can afford to replay. Strands’ BeforeToolCallEvent is the gate on the in-process path. Evaluate the intersection, not the union: what this agent is allowed to do, and what this user is allowed to do, per action. Composio’s hosted MCP path skips the SDK hooks. Do not put the refund on that path. Search and schema fetch can live there. The write that moves money stays in-process, behind the cancel.
Observability is the last layer, and it is debug, not evidence. Arize Phoenix 20.4.0 shipped August 26. It traces agents as trees: model call, tool call, retry, the span that shows which hook cancelled the refund. Langfuse’s Python SDK is 4.14.5, uploaded August 24. The platform tagged v4.19.0 on August 25. Phoenix for depth, self-hosted, inside the VPC. Langfuse when you want prompt versions, a simpler deploy, or an EU-hosted option. Instrument both if you have the audience split. Instrument Phoenix alone if you are still the only person who will open the trace. Neither one is an audit trail. I wrote that in July. The examiner wants which agent, acting for which user, called which tool, against which resource, under which policy, and why the runtime allowed it. A span is not that record. Keep the hashed append-only log if you are in the regulated case. Keep Phoenix so you can fix the loop.
Where this flexes is the parts you can swap without breaking the class. Skip Composio until the fifth SaaS toolkit. Five MCP servers you wrote are cheaper than a hosted catalog you do not yet need. Skip Agent Vault if every tool is a connector you own and the secret never enters the process; that is the Harbor pattern without the dormant SDK. Skip Lambda if the agent is personal and the worst case is a bad file in a sandboxed directory. Skip Langfuse until someone asks for a prompt version. The fixed parts do not flex. Discovery outside the runtime. Secrets outside the process. A hook that can refuse. Traces you can replay. Drop the secret into the agent’s environment and a rotation is an outage, no matter how pretty the registry looks.
What it costs is mostly operational discipline, then rent, then a CA. Every new tool needs a home in one of the three execution shapes before it ships. Every Composio connection needs a user_id that will still mean something when the engineer who clicked Allow leaves. Agent Vault needs certificate distribution and an egress deny that makes HTTPS_PROXY a boundary instead of a suggestion. Phoenix needs a Postgres and someone who will look at a trace at 2 a.m. Harbor-as-a-pattern needs a process boundary you actually maintain. I would not stand all four layers up on a Friday against a live billing API. I would stand discovery and the hook against a read-only tool, then move the secret out of the environment, then add traces, then let the first write through.
The starting point is smaller than the diagram. One MCP server you own. One runtime hook that can cancel. One secret in a vault or a connector, never in the process. One Phoenix instance, even if it is a container on the same box. Add Composio when the long tail appears. Add Agent Vault when the agent has a filesystem and you cannot trust the next document. Add Langfuse when prompt versions become an argument. Leave the agent-principal blank on the diagram on purpose. If you fill it with a shared service account, you will not be able to answer the CISO after the first bad tool call.
Thursday I will look at OpenConnector, which treats the question as governance rather than catalog: not can the agent find the tool, but should this agent be allowed to use it, and can you prove that to an auditor. Tonight the test is plainer. Rotate a key. If the agent keeps running, you built the stack. If you have to bounce the process, you built a demo with a calendar reminder.
If this was useful, forward it to one engineer who needs less noise in their feed.