4 Min. Lesezeit
Claude Managed Agents Can Write Its Own Workflow. Should Yours Use One?
Anthropic's beta lets a Claude agent write and run a multi-agent workflow itself. Here's the worked setup, the real limits, and when to turn it on.
BOTBENTO / BLOG
Feldnotizen aus der Agent-Welt
Praktische Leitfäden zu KI-Agents, Workflows, Tools und Berechtigungen. Eigene, mit Quellen belegte Erklärungen von BotBento.
Artikel werden auf Englisch veröffentlicht.
4 Min. Lesezeit
A2A Protocol Hit v1.0. Does Your Small-Team Bot Actually Need It?
A2A reached a stable v1.0 spec in 2026. Here's a decision rule for whether a personal or small-team bot should adopt it or just call another bot's API directly.
4 Min. Lesezeit
Claude's Web Fetch Tool Checks Where a URL Came From, Not What It Is
Claude's web_fetch tool only follows URLs with a known origin. Here's what counts, what doesn't, and how Managed Agents now layer a host allowlist on top.
4 Min. Lesezeit
Claude Code Hooks: Which Event Actually Blocks a Tool Call?
PreToolUse can gate any matching tool call before execution; PermissionRequest can deny calls in the permission-decision path. PostToolUse reacts afterward.
5 Min. Lesezeit
Before You Install a Claude Code Plugin, Check What the Marketplace Actually Vetted
A plugin marketplace's name tells you who hosts the catalog, not what each plugin does. Here's what to check before you install one.
4 Min. Lesezeit
Claude Agent SDK Subagents: Tools Field Restricts, Permission Mode Doesn't Always
A narrow tools list on a Claude Agent SDK subagent is a hard boundary. Its permissionMode setting often isn't. Here's what actually holds.
4 Min. Lesezeit
OpenAI's Hosted Evals Goes Read-Only Oct 31. What Now?
OpenAI's hosted Evals dashboard and API are closing. Here's what to export before the read-only date and how to keep grading your bot's tool calls.
4 Min. Lesezeit
MCP Removed Stream Resumability. What Happens When Your Bot's Call Drops?
The 2026-07-28 MCP transport removed Last-Event-ID replay for response streams. Learn what a dropped tool call does and when retrying is safe.
4 Min. Lesezeit
How Do You Test a Bot's Email Routine Without Spamming Real Inboxes?
Sandbox mode validates a request's shape, not delivery. Here's how to combine it with a dedicated test account to test an email-sending bot safely.
5 Min. Lesezeit
Should Your Bot Force a Tool Call, or Let Claude Decide?
A decision guide to Claude's tool_choice modes: when auto is safe, when forcing a call helps, and which models reject forced tool use.
4 Min. Lesezeit
MCP Server Instructions: Should Your Bot Follow Them?
MCP discovery can include optional server-written instructions. Learn when clients receive them, how to review them, and why they cannot authorize tool use.
5 Min. Lesezeit
What Should Actually Persist in Your Bot's Memory Across Sessions?
A session-scoped bot forgets everything on restart. Before you turn on persistent memory, decide what should survive and who can write to it.
3 Min. Lesezeit
MCP Registry Lists a Server. Does That Mean Your Bot Should Trust It?
The official MCP Registry verifies publisher namespace ownership, not server behavior. Learn what to check before connecting a bot to a listed server.
4 Min. Lesezeit
How Do You Defend a Bot Against a Prompt Injection Hidden in a Tool Result?
A tool's output can contain instructions, not just data. Here's how to design approval gates and scopes so an injected instruction can't silently execute.
3 Min. Lesezeit
MCP Tool Annotations: Can Your Bot Actually Trust readOnlyHint?
MCP tools can declare readOnlyHint, destructiveHint, idempotentHint and openWorldHint. Here's what those hints prove, what they don't, and how to use them safely.
4 Min. Lesezeit
Your Bot's MCP Client Picked a Version. What If the Server Disagrees?
MCP 2026-07-28 dropped the initialize handshake for per-request version checks. Here's what your bot should do when a server rejects its version.
3 Min. Lesezeit
MCP Replaced Server-Initiated Requests With MRTR. What Changes for Your Bot?
MCP's 2026-07-28 specification introduced Multi Round-Trip Requests for server requests. Learn the result-and-retry flow and the compatibility checks your bot needs.
4 Min. Lesezeit
Can You Give a Bot Calendar Write Access Without Delete Permission?
Google and Microsoft calendar scopes bundle delete with write. Here's what that means for a bot's OAuth setup and what to do instead.
5 Min. Lesezeit
What Should Your Bot Do When It Hits the Context Window Mid-Task?
How to distinguish an oversized input error, an output that reaches the context limit, and configured compaction—and what a bot should record before retrying.
4 Min. Lesezeit
Agent Skills' allowed-tools Field Won't Sandbox a Skill by Itself
SKILL.md can declare allowed-tools, but the open spec marks it experimental. Here's what to check before letting a bot load someone else's skill.
5 Min. Lesezeit
MCP Added a Tasks Extension for Long Jobs. Should Your Bot Use It Yet?
The 2026-07-28 MCP Tasks extension returns a durable task handle for some long tool calls. Learn the current tasks/get lifecycle, failure states and adoption checks.
5 Min. Lesezeit
MCP Deprecated Dynamic Client Registration. What Should Your Bot Use Now?
MCP 2026-07-28 deprecates Dynamic Client Registration. Compare pre-registration, portable CIMD client IDs and the conditional DCR fallback for HTTP OAuth clients.
4 Min. Lesezeit
MCP Has a Prompts Primitive. Should Your Bot Actually Use It?
MCP prompts are reusable templates, not a permission gate. Learn how the 2026-07-28 protocol lists and caches them, and when a workflow also needs a tool.
5 Min. Lesezeit
How Do You Trace a Bot's Tool Calls to Debug a Failed Run?
Use OpenTelemetry's developing GenAI and MCP span conventions to trace bot tool calls, distinguish span kinds, and verify outcomes separately.
4 Min. Lesezeit
How Do You Stop a Replayed Webhook From Re-Triggering Your Bot?
A worked example of signature verification, timestamp tolerance and event-ID dedup so a captured webhook can't fire your bot's actions twice.
4 Min. Lesezeit
Authorization Code or Client Credentials: Which OAuth Grant Should Your Bot Use?
A practical guide to choosing authorization code or client credentials for bot tool connections, using the current MCP authorization specification and OAuth standards.
5 Min. Lesezeit
MCP Tools Can Change Mid-Session. How Does Your Bot Find Out Now?
Under the current MCP spec, tool-list change notifications are opt-in. Here's what your bot must do to not miss them.
5 Min. Lesezeit
Which of Your Bot's Tool Calls Actually Need a Human Approval Gate?
A worked method for sorting a bot's tools into auto-approve, ask-first, and always-deny tiers, using MCP, Claude Agent SDK, and OpenAI Agents SDK as evidence.
5 Min. Lesezeit
How Do You Rotate a Bot's API Credentials Without Breaking Its Routines?
A worked plan for rotating a long-running bot's API keys or OAuth tokens so scheduled jobs don't fail mid-cycle, with the spec rules that apply.
3 Min. Lesezeit
Can Your Bot Trust an MCP Progress Notification?
MCP progress updates are optional during a tool call. Learn what they prove, how current Tasks differ, and when a bot should verify the final result.
4 Min. Lesezeit
What Actually Happens When Your Bot Cancels an MCP Tool Call?
MCP cancellation asks a server to stop work, but it may still finish. Learn the current stdio and HTTP rules and how to check side effects.
4 Min. Lesezeit
How Do You Scope an API Key So a Bot Can't Exceed Its Job?
A practical Stripe and GitHub example for limiting a bot's credential to its job, with the permissions to verify and the failure paths to test.
4 Min. Lesezeit
MCP Roots Is Deprecated. Where Should Your Bot's File Boundaries Live Now?
MCP Roots is deprecated in the 2026-07-28 spec. Learn what remains supported, why roots are advisory, and how to migrate file scoping safely.
4 Min. Lesezeit
How Do You Know Your Bot's Recurring Routine Has Gone Silent?
A scheduled bot can miss its start, fail to reach its target, or stall after starting. Each silence needs a different signal and a clear recovery path.
4 Min. Lesezeit
How Long Should You Let a Bot's Tool Call Run Before Timing Out?
A practical guide to MCP tool-call timeouts: distinguish protocol guidance from client defaults, measure real durations, and use asynchronous jobs for slow work.
4 Min. Lesezeit
MCP Tools Can Declare an Output Schema. Should Your Bot Validate It?
MCP tools can declare an outputSchema and return structuredContent. Here is how to validate successful results without confusing tool errors with transport failures.
4 Min. Lesezeit
MCP Dropped Sessions. How Do You Keep State Across Tool Calls Now?
The MCP 2026-07-28 spec removed session IDs and the initialize handshake. Here's the explicit-handle pattern that replaces them, and what breaks if you don't update.
5 Min. Lesezeit
What Should a Bot Do When a Multi-Step Task Fails Halfway?
A bot that books a flight then fails to book a hotel has left the world in a half-finished state. Here is how to design the undo step.
4 Min. Lesezeit
How Do You Actually Revoke a Bot's Access to a Tool It No Longer Uses?
OAuth token revocation can have a propagation delay. Learn what the standard guarantees, how validation affects the result, and how to verify a bot has stopped using a tool.
4 Min. Lesezeit
MCP Tool Results: How Do You Know a Call Actually Succeeded?
Read MCP protocol errors, isError, structuredContent and real-world readback separately before telling a user a tool action succeeded.
3 Min. Lesezeit
How Do You Verify an AI Agent Actually Finished the Task?
A bot saying 'done' is not proof. Here is how to check completion independently, with a worked example and what evidence to keep.
3 Min. Lesezeit
When Should a Bot Use a Supervisor Agent Instead of One Agent With Tools?
A concrete rule for choosing between one agent with many tools and a supervisor that delegates to specialist agents, with a worked example.
4 Min. Lesezeit
MCP Sampling Is Deprecated. What Should Bot Builders Do Now?
MCP's sampling feature, which let servers ask your client to run an LLM call, is now deprecated. Here is what that means for bots built on it.
4 Min. Lesezeit
How Should an AI Bot Handle a Tool's Rate Limit Error?
Learn how an AI bot should classify rate limits, honor Retry-After, retry safely with jitter and a cap, and report an unfinished tool action.
4 Min. Lesezeit
What Can an MCP Tool Ask You For Mid-Task, and What Can't It?
MCP elicitation lets a connected tool pause and ask a question mid-task. Here's what the spec allows it to request, and what it must route elsewhere.
4 Min. Lesezeit
How Do You Stop a Retried Tool Call From Running Twice?
A timed-out tool call can secretly succeed. See why MCP's idempotentHint doesn't protect you, and what an idempotency key actually does.
3 Min. Lesezeit
How Do You Review an AI-Generated Research Note?
A practical checklist for checking source ownership, dates, contradictions and unresolved questions in AI-drafted research notes before you rely on them.
4 Min. Lesezeit
MCP Resource Indicators: What Your Bot's OAuth Tokens Must Specify
MCP's HTTP authorization spec requires OAuth resource indicators. Learn what they protect, where implementation can fail, and what to check before connecting a bot.
5 Min. Lesezeit
Plugin or authorized connection: what's actually different?
Installing a tool on a bot and letting it act on your data are two separate steps. Here is where the line sits, with a worked example.
4 Min. Lesezeit
Why we are building BotBento around people, not just bots
Grok Bot's group chats hold bots only. BotBento is built so people and bots share one room under one permission model. Here is the reasoning and the honest status.
5 Min. Lesezeit
How do you test an AI agent that uses a calendar?
Test a calendar AI agent with a disposable event, explicit time zone, denied write and revoked connection. Check the saved result before trusting its reply.
4 Min. Lesezeit
What belongs in an AI agent stopping rule?
Define when an AI agent should finish, pause or stop at a limit, with an illustrative research task and practical checks for loops and unresolved work.
5 Min. Lesezeit
Local or cloud: where should your AI agent run?
Choose where an AI agent runs by separating its model, tools and scheduler. Compare local, cloud and hybrid setups with a practical decision checklist.
5 Min. Lesezeit
What should an AI agent record after each run?
Design a useful AI agent run record with evidence, partial results, retry decisions and clear next steps, using an illustrative research routine.
5 Min. Lesezeit
MCP tool permissions: what to check before connecting a bot
Understand MCP servers, authorization and tool approval with an illustrative calendar example and a practical connection review checklist.
5 Min. Lesezeit
AI agents vs workflows: choose who decides the next step
A practical way to choose between an AI agent and a fixed workflow, with a weekly research example, stopping rules and an evaluation checklist.