Canonical: https://botbento.com/de/blog/
Format: Markdown representation of the public HTML page.

BOTBENTO / BLOG

# Feldnotizen aus der Agent-Welt

Praktische Leitfäden zu KI-Agents, Workflows, Tools und Berechtigungen. Eigene, mit Quellen belegte Erklärungen von BotBento.

Artikel werden auf Englisch veröffentlicht.

2026-10-174 Min. Lesezeit

## [Claude Managed Agents Can Write Its Own Workflow. Should Yours Use One? ](/blog/claude-managed-agents-dynamic-workflows/)

Anthropic's beta lets a Claude agent write and run a multi-agent workflow itself. Here's the worked setup, the real limits, and when to turn it on.

2026-10-174 Min. Lesezeit

## [A2A Protocol Hit v1.0. Does Your Small-Team Bot Actually Need It? ](/blog/a2a-protocol-does-your-bot-need-it/)

A2A reached a stable v1.0 spec in 2026. Here's a decision rule for whether a personal or small-team bot should adopt it or just call another bot's API directly.

2026-10-164 Min. Lesezeit

## [Claude's Web Fetch Tool Checks Where a URL Came From, Not What It Is ](/blog/claude-web-fetch-url-provenance-rule/)

Claude's web\_fetch tool only follows URLs with a known origin. Here's what counts, what doesn't, and how Managed Agents now layer a host allowlist on top.

2026-10-164 Min. Lesezeit

## [Claude Code Hooks: Which Event Actually Blocks a Tool Call? ](/blog/claude-code-hooks-pretooluse-vs-posttooluse/)

PreToolUse can gate any matching tool call before execution; PermissionRequest can deny calls in the permission-decision path. PostToolUse reacts afterward.

2026-10-155 Min. Lesezeit

## [Before You Install a Claude Code Plugin, Check What the Marketplace Actually Vetted ](/blog/claude-code-plugin-marketplace-trust-tiers/)

A plugin marketplace's name tells you who hosts the catalog, not what each plugin does. Here's what to check before you install one.

2026-10-154 Min. Lesezeit

## [Claude Agent SDK Subagents: Tools Field Restricts, Permission Mode Doesn't Always ](/blog/claude-agent-sdk-subagent-tools-vs-permission-mode/)

A narrow tools list on a Claude Agent SDK subagent is a hard boundary. Its permissionMode setting often isn't. Here's what actually holds.

2026-10-144 Min. Lesezeit

## [OpenAI's Hosted Evals Goes Read-Only Oct 31. What Now? ](/blog/openai-evals-shutdown-what-to-do/)

OpenAI's hosted Evals dashboard and API are closing. Here's what to export before the read-only date and how to keep grading your bot's tool calls.

2026-10-144 Min. Lesezeit

## [MCP Removed Stream Resumability. What Happens When Your Bot's Call Drops? ](/blog/mcp-2026-resumability-removed-retry/)

The 2026-07-28 MCP transport removed Last-Event-ID replay for response streams. Learn what a dropped tool call does and when retrying is safe.

2026-10-134 Min. Lesezeit

## [How Do You Test a Bot's Email Routine Without Spamming Real Inboxes? ](/blog/bot-email-routine-testing-without-spam/)

Sandbox mode validates a request's shape, not delivery. Here's how to combine it with a dedicated test account to test an email-sending bot safely.

2026-10-135 Min. Lesezeit

## [Should Your Bot Force a Tool Call, or Let Claude Decide? ](/blog/anthropic-tool-choice-force-or-auto/)

A decision guide to Claude's tool\_choice modes: when auto is safe, when forcing a call helps, and which models reject forced tool use.

2026-10-124 Min. Lesezeit

## [MCP Server Instructions: Should Your Bot Follow Them? ](/blog/mcp-server-instructions-field-trust/)

MCP discovery can include optional server-written instructions. Learn when clients receive them, how to review them, and why they cannot authorize tool use.

2026-10-125 Min. Lesezeit

## [What Should Actually Persist in Your Bot's Memory Across Sessions? ](/blog/bot-memory-across-sessions-what-to-persist/)

A session-scoped bot forgets everything on restart. Before you turn on persistent memory, decide what should survive and who can write to it.

2026-10-113 Min. Lesezeit

## [MCP Registry Lists a Server. Does That Mean Your Bot Should Trust It? ](/blog/mcp-registry-listing-not-vetting/)

The official MCP Registry verifies publisher namespace ownership, not server behavior. Learn what to check before connecting a bot to a listed server.

2026-10-114 Min. Lesezeit

## [How Do You Defend a Bot Against a Prompt Injection Hidden in a Tool Result? ](/blog/defending-against-prompt-injection-in-tool-results/)

A tool's output can contain instructions, not just data. Here's how to design approval gates and scopes so an injected instruction can't silently execute.

2026-10-103 Min. Lesezeit

## [MCP Tool Annotations: Can Your Bot Actually Trust readOnlyHint? ](/blog/mcp-tool-annotations-trust-hints/)

MCP tools can declare readOnlyHint, destructiveHint, idempotentHint and openWorldHint. Here's what those hints prove, what they don't, and how to use them safely.

2026-10-104 Min. Lesezeit

## [Your Bot's MCP Client Picked a Version. What If the Server Disagrees? ](/blog/mcp-protocol-version-mismatch-what-happens/)

MCP 2026-07-28 dropped the initialize handshake for per-request version checks. Here's what your bot should do when a server rejects its version.

2026-10-093 Min. Lesezeit

## [MCP Replaced Server-Initiated Requests With MRTR. What Changes for Your Bot? ](/blog/mcp-mrtr-elicitation-sampling-roots/)

MCP's 2026-07-28 specification introduced Multi Round-Trip Requests for server requests. Learn the result-and-retry flow and the compatibility checks your bot needs.

2026-10-094 Min. Lesezeit

## [Can You Give a Bot Calendar Write Access Without Delete Permission? ](/blog/calendar-bot-write-without-delete-scope/)

Google and Microsoft calendar scopes bundle delete with write. Here's what that means for a bot's OAuth setup and what to do instead.

2026-10-085 Min. Lesezeit

## [What Should Your Bot Do When It Hits the Context Window Mid-Task? ](/blog/bot-context-window-overflow-mid-task/)

How to distinguish an oversized input error, an output that reaches the context limit, and configured compaction—and what a bot should record before retrying.

2026-10-084 Min. Lesezeit

## [Agent Skills' allowed-tools Field Won't Sandbox a Skill by Itself ](/blog/agent-skills-allowed-tools-is-not-a-sandbox/)

SKILL.md can declare allowed-tools, but the open spec marks it experimental. Here's what to check before letting a bot load someone else's skill.

2026-10-075 Min. Lesezeit

## [MCP Added a Tasks Extension for Long Jobs. Should Your Bot Use It Yet? ](/blog/mcp-tasks-extension-long-running-calls/)

The 2026-07-28 MCP Tasks extension returns a durable task handle for some long tool calls. Learn the current tasks/get lifecycle, failure states and adoption checks.

2026-10-075 Min. Lesezeit

## [MCP Deprecated Dynamic Client Registration. What Should Your Bot Use Now? ](/blog/mcp-client-registration-cimd-vs-dcr/)

MCP 2026-07-28 deprecates Dynamic Client Registration. Compare pre-registration, portable CIMD client IDs and the conditional DCR fallback for HTTP OAuth clients.

2026-10-064 Min. Lesezeit

## [MCP Has a Prompts Primitive. Should Your Bot Actually Use It? ](/blog/mcp-prompts-primitive-explained/)

MCP prompts are reusable templates, not a permission gate. Learn how the 2026-07-28 protocol lists and caches them, and when a workflow also needs a tool.

2026-10-065 Min. Lesezeit

## [How Do You Trace a Bot's Tool Calls to Debug a Failed Run? ](/blog/bot-tool-call-tracing-otel/)

Use OpenTelemetry's developing GenAI and MCP span conventions to trace bot tool calls, distinguish span kinds, and verify outcomes separately.

2026-10-054 Min. Lesezeit

## [How Do You Stop a Replayed Webhook From Re-Triggering Your Bot? ](/blog/webhook-replay-protection-bot-triggers/)

A worked example of signature verification, timestamp tolerance and event-ID dedup so a captured webhook can't fire your bot's actions twice.

2026-10-044 Min. Lesezeit

## [Authorization Code or Client Credentials: Which OAuth Grant Should Your Bot Use? ](/blog/oauth-grant-type-bot-tool-connection/)

A practical guide to choosing authorization code or client credentials for bot tool connections, using the current MCP authorization specification and OAuth standards.

2026-10-045 Min. Lesezeit

## [MCP Tools Can Change Mid-Session. How Does Your Bot Find Out Now? ](/blog/mcp-tools-list-changed-stateless/)

Under the current MCP spec, tool-list change notifications are opt-in. Here's what your bot must do to not miss them.

2026-10-035 Min. Lesezeit

## [Which of Your Bot's Tool Calls Actually Need a Human Approval Gate? ](/blog/bot-tool-approval-what-needs-a-human-gate/)

A worked method for sorting a bot's tools into auto-approve, ask-first, and always-deny tiers, using MCP, Claude Agent SDK, and OpenAI Agents SDK as evidence.

2026-10-035 Min. Lesezeit

## [How Do You Rotate a Bot's API Credentials Without Breaking Its Routines? ](/blog/bot-credential-rotation-without-downtime/)

A worked plan for rotating a long-running bot's API keys or OAuth tokens so scheduled jobs don't fail mid-cycle, with the spec rules that apply.

2026-10-023 Min. Lesezeit

## [Can Your Bot Trust an MCP Progress Notification? ](/blog/mcp-progress-notifications-trust/)

MCP progress updates are optional during a tool call. Learn what they prove, how current Tasks differ, and when a bot should verify the final result.

2026-10-014 Min. Lesezeit

## [What Actually Happens When Your Bot Cancels an MCP Tool Call? ](/blog/mcp-tool-call-cancellation-what-happens/)

MCP cancellation asks a server to stop work, but it may still finish. Learn the current stdio and HTTP rules and how to check side effects.

2026-10-014 Min. Lesezeit

## [How Do You Scope an API Key So a Bot Can't Exceed Its Job? ](/blog/bot-api-key-scoping-least-privilege/)

A practical Stripe and GitHub example for limiting a bot's credential to its job, with the permissions to verify and the failure paths to test.

2026-09-304 Min. Lesezeit

## [MCP Roots Is Deprecated. Where Should Your Bot's File Boundaries Live Now? ](/blog/mcp-roots-deprecated-migration/)

MCP Roots is deprecated in the 2026-07-28 spec. Learn what remains supported, why roots are advisory, and how to migrate file scoping safely.

2026-09-304 Min. Lesezeit

## [How Do You Know Your Bot's Recurring Routine Has Gone Silent? ](/blog/bot-routine-silent-failure-detection/)

A scheduled bot can miss its start, fail to reach its target, or stall after starting. Each silence needs a different signal and a clear recovery path.

2026-09-294 Min. Lesezeit

## [How Long Should You Let a Bot's Tool Call Run Before Timing Out? ](/blog/tool-call-timeout-duration/)

A practical guide to MCP tool-call timeouts: distinguish protocol guidance from client defaults, measure real durations, and use asynchronous jobs for slow work.

2026-09-294 Min. Lesezeit

## [MCP Tools Can Declare an Output Schema. Should Your Bot Validate It? ](/blog/mcp-tool-output-schema-validation/)

MCP tools can declare an outputSchema and return structuredContent. Here is how to validate successful results without confusing tool errors with transport failures.

2026-09-284 Min. Lesezeit

## [MCP Dropped Sessions. How Do You Keep State Across Tool Calls Now? ](/blog/mcp-stateless-cross-call-state/)

The MCP 2026-07-28 spec removed session IDs and the initialize handshake. Here's the explicit-handle pattern that replaces them, and what breaks if you don't update.

2026-09-285 Min. Lesezeit

## [What Should a Bot Do When a Multi-Step Task Fails Halfway? ](/blog/bot-multi-step-task-failure-rollback/)

A bot that books a flight then fails to book a hotel has left the world in a half-finished state. Here is how to design the undo step.

2026-09-274 Min. Lesezeit

## [How Do You Actually Revoke a Bot's Access to a Tool It No Longer Uses? ](/blog/revoke-bot-tool-access/)

OAuth token revocation can have a propagation delay. Learn what the standard guarantees, how validation affects the result, and how to verify a bot has stopped using a tool.

2026-09-274 Min. Lesezeit

## [MCP Tool Results: How Do You Know a Call Actually Succeeded? ](/blog/mcp-tool-result-success-signal/)

Read MCP protocol errors, isError, structuredContent and real-world readback separately before telling a user a tool action succeeded.

2026-09-263 Min. Lesezeit

## [How Do You Verify an AI Agent Actually Finished the Task? ](/blog/verify-ai-agent-task-completion/)

A bot saying 'done' is not proof. Here is how to check completion independently, with a worked example and what evidence to keep.

2026-09-263 Min. Lesezeit

## [When Should a Bot Use a Supervisor Agent Instead of One Agent With Tools? ](/blog/supervisor-agent-vs-single-agent-tools/)

A concrete rule for choosing between one agent with many tools and a supervisor that delegates to specialist agents, with a worked example.

2026-09-254 Min. Lesezeit

## [MCP Sampling Is Deprecated. What Should Bot Builders Do Now? ](/blog/mcp-sampling-deprecated/)

MCP's sampling feature, which let servers ask your client to run an LLM call, is now deprecated. Here is what that means for bots built on it.

2026-09-254 Min. Lesezeit

## [How Should an AI Bot Handle a Tool's Rate Limit Error? ](/blog/ai-bot-rate-limit-error-handling/)

Learn how an AI bot should classify rate limits, honor Retry-After, retry safely with jitter and a cap, and report an unfinished tool action.

2026-09-244 Min. Lesezeit

## [What Can an MCP Tool Ask You For Mid-Task, and What Can't It? ](/blog/mcp-elicitation-mid-task-permissions/)

MCP elicitation lets a connected tool pause and ask a question mid-task. Here's what the spec allows it to request, and what it must route elsewhere.

2026-09-244 Min. Lesezeit

## [How Do You Stop a Retried Tool Call From Running Twice? ](/blog/agent-tool-retry-idempotency-keys/)

A timed-out tool call can secretly succeed. See why MCP's idempotentHint doesn't protect you, and what an idempotency key actually does.

2026-09-233 Min. Lesezeit

## [How Do You Review an AI-Generated Research Note? ](/blog/reviewing-ai-generated-research-notes/)

A practical checklist for checking source ownership, dates, contradictions and unresolved questions in AI-drafted research notes before you rely on them.

2026-09-234 Min. Lesezeit

## [MCP Resource Indicators: What Your Bot's OAuth Tokens Must Specify ](/blog/mcp-resource-indicator-requirement/)

MCP's HTTP authorization spec requires OAuth resource indicators. Learn what they protect, where implementation can fail, and what to check before connecting a bot.

2026-09-205 Min. Lesezeit

## [Plugin or authorized connection: what's actually different? ](/blog/plugin-vs-authorized-connection/)

Installing a tool on a bot and letting it act on your data are two separate steps. Here is where the line sits, with a worked example.

2026-09-204 Min. Lesezeit

## [Why we are building BotBento around people, not just bots ](/blog/people-and-bots-in-one-room/)

Grok Bot's group chats hold bots only. BotBento is built so people and bots share one room under one permission model. Here is the reasoning and the honest status.

2026-09-105 Min. Lesezeit

## [How do you test an AI agent that uses a calendar? ](/blog/test-calendar-ai-agent/)

Test a calendar AI agent with a disposable event, explicit time zone, denied write and revoked connection. Check the saved result before trusting its reply.

2026-09-104 Min. Lesezeit

## [What belongs in an AI agent stopping rule? ](/blog/ai-agent-stopping-rules/)

Define when an AI agent should finish, pause or stop at a limit, with an illustrative research task and practical checks for loops and unresolved work.

2026-09-085 Min. Lesezeit

## [Local or cloud: where should your AI agent run? ](/blog/local-vs-cloud-ai-agents/)

Choose where an AI agent runs by separating its model, tools and scheduler. Compare local, cloud and hybrid setups with a practical decision checklist.

2026-09-085 Min. Lesezeit

## [What should an AI agent record after each run? ](/blog/ai-agent-run-result-record/)

Design a useful AI agent run record with evidence, partial results, retry decisions and clear next steps, using an illustrative research routine.

2026-09-075 Min. Lesezeit

## [MCP tool permissions: what to check before connecting a bot ](/blog/mcp-tool-permissions/)

Understand MCP servers, authorization and tool approval with an illustrative calendar example and a practical connection review checklist.

2026-09-075 Min. Lesezeit

## [AI agents vs workflows: choose who decides the next step ](/blog/ai-agents-vs-workflows/)

A practical way to choose between an AI agent and a fixed workflow, with a weekly research example, stopping rules and an evaluation checklist.