iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Use Strands Agents SDK for the agent loop and Model Context Protocol (MCP) for the connection to your systems. That division lets an agent running inside your Python or TypeScript application discover approved tools and data without hard-coding a separate integration for every model provider or backend. MCP standardizes the messages and capabilities exchanged with external servers; your application still owns business rules, authorization, approvals, and error handling.
If you are asking, “How do I connect an AI agent to my software systems using MCP?”, the practical sequence is: define the smallest useful integration boundary, choose Python or TypeScript and a model provider, start an MCP client in your application, obtain the server’s tools, pass those tools to a Strands Agent, then add authorization, observability, and dependency controls before production.
![Claude AI for Beginners Bible: [5 in 1] The Ultimate Guide to Automate Your Work, Save Hours Every Week, and Use AI for Real-World Results](https://m.media-amazon.com/images/I/415+fSJacsL._SL160_.jpg)
Understand the division of responsibility
MCP is an open protocol for connecting AI applications to external systems, including data sources, tools, and workflows. It is an integration protocol, not your application’s business-logic layer and not a security guarantee. Strands Agents SDK is the framework that runs the agent loop in your process: it sends model requests, presents available tools, handles tool calls, and returns the model’s response.
| Part | What it does | What it does not do |
|---|---|---|
| Host application | Your web service, worker, desktop app, or other process. It owns user identity, business rules, secrets, approvals, persistence, and response handling. | It should not let the model bypass authorization merely because a tool is available. |
| Strands Agent | Runs the agent loop in Python or TypeScript and connects model reasoning to the tools you provide. | It is not a hosted control plane that automatically secures every backend operation. |
| MCP client | A connector inside the host. It negotiates capabilities and exchanges protocol messages with an MCP server. | It does not decide whether a requested business action is allowed for a particular user. |
| MCP server | Supplies approved resources, prompts, and tools for a data source or service. | Its tool descriptions and behavior should not be trusted automatically merely because they are presented through MCP. |
The MCP specification defines stateful connections and capability negotiation using JSON-RPC 2.0 messages. A host can create one or more clients; each client connects to a server that offers capabilities. Server features include:
#1 Best Overall
- Resources: context and data that an application can retrieve.
- Prompts: reusable, templated messages or workflows.
- Tools: functions that the model can request through the agent.
Client-side capabilities can include sampling, roots, and elicitation. Whether a particular server or SDK supports a capability is negotiated, so design for the capabilities you actually need instead of assuming every server implements all of them.
The specification describes the protocol as enabling “powerful capabilities through arbitrary data access and code execution paths.” Treat that as a security boundary: an MCP connection can expose more than read-only text, and the protocol itself cannot enforce your organization’s consent, privacy, or authorization policy.
Choose the application shape before writing tools
Define one bounded job
Start with a task whose inputs, permitted data, and acceptable side effects are explicit. Examples include answering questions from an internal knowledge base, looking up an order, or preparing (but not submitting) a change request. A narrow boundary makes tool descriptions, credentials, tests, and approvals tractable.
Choose Python or TypeScript
The current Strands documentation covers both Python and TypeScript. Select the language already used by the service that will host the agent. The SDK runs inside that process, so you can reuse its request handling, configuration, logging, and deployment model rather than introducing a separate hosted agent service.
Select a model provider independently of MCP
MCP determines how the agent reaches context and capabilities; it does not determine which model generates the plan. The Strands quickstart describes Amazon Bedrock as the default in its setup and documents provider substitutions. Provider availability, credentials, model identifiers, and regional requirements change, so verify the provider’s current Strands instructions when configuring your environment. Keep provider selection in configuration rather than embedding it in tool code.
Decide where the MCP server runs
A server may be started as a child process, reached through another supported transport, or operated as a separately deployed service. The Python README’s example uses a standard-input/standard-output (stdio) server. That is a useful local-development pattern, not a requirement that every deployment or server use stdio. Record the transport and startup parameters as part of your deployment specification.
Install and pin compatible dependencies
Install the Strands SDK, its tools package when your chosen integration requires it, and the MCP package using the commands and package names in the current Python README. A typical environment starts with:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutepython -m venv .venv
. .venv/bin/activate
python -m pip install --upgrade pip
pip install strands-agents strands-agents-tools mcpUse the exact package names and installation guidance for your SDK release; the command above illustrates the dependency shape rather than promising a permanent version. The current Python README documents compatibility with both major mcp package versions. A fresh installation resolves to the 2.x line; specify mcp<2 when you must remain on 1.x. Pin the versions you test and record the server version and transport assumptions alongside them.
Before deployment, create a lock file, install from that lock file in CI, and run a smoke test that starts the MCP connection and lists tools. A successful package installation does not prove that your selected server, transport, model provider, and credentials are mutually compatible.
Build a minimal Python agent with an MCP server
The following pattern mirrors the Python README: construct an MCPClient around a stdio transport, enter the client context, list tools, and give those tools to a Strands Agent. The server command is illustrative; replace it with a server you have reviewed and configured.
- Create a server configuration. Decide the executable, arguments, environment variables, working directory, and timeout. Do not put secrets directly in source code.
- Create the MCP client. Use the transport helper and server parameters supported by the versions you pinned.
- Open the connection. Enter the client context before requesting tools so initialization and capability negotiation complete.
- Discover tools. Call the synchronous or asynchronous listing method appropriate for your request path.
- Construct the agent. Pass only the tools required for this use case.
- Invoke the agent. Give it a bounded instruction and handle model, transport, and tool errors at the application boundary.
from mcp import StdioServerParameters, stdio_client
from strands import Agent
from strands.tools.mcp import MCPClient
server_params = StdioServerParameters(
command="uvx",
args=["your-reviewed-mcp-server"],
)
mcp_client = MCPClient(lambda: stdio_client(server_params))
with mcp_client:
tools = mcp_client.list_tools_sync()
agent = Agent(tools=tools)
result = agent(
"Answer the user's question using only the connected documentation tools. "
"If the tools do not contain enough evidence, say what is missing."
)
print(result)The official example uses an AWS documentation MCP server to demonstrate the pattern. That server is not a required component. Substitute a server that exposes the data or actions your application needs, and review its implementation and permissions before connecting it to production data.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsMake the first request observable
During development, log the connection lifecycle, negotiated capabilities, discovered tool names, latency, and sanitized error details. Do not log access tokens, full customer records, or tool arguments that contain secrets. Confirm that a tool call is visible in your application logs and that a denied or malformed call fails closed.
Place the agent inside an existing web service
Strands’ quickstart describes an agent integrated into applications such as FastAPI, Express, or Next.js. A request normally follows this sequence:
- Your route authenticates the caller and determines the tenant, role, and data scope.
- The application creates or reuses an MCP connection according to the transport’s lifecycle requirements.
- The application selects the allowed tool set for that caller and task.
- The agent receives the user request plus explicit instructions about scope, evidence, and prohibited actions.
- Each tool invocation is checked by application policy before it reaches the backend.
- The route enforces timeouts, converts failures into safe responses, and records an audit event.
Whether to create a client per request, per worker, or per session depends on transport behavior, concurrency, and server state. Do not assume that a connection can be shared safely across requests. Decide how conversation state is stored, how long it lives, and how it is isolated between users and tenants. The model provider is an external service in the quickstart’s architecture, so account for network latency, provider errors, regional availability, and credential rotation in your service design.
# Framework-neutral request flow (pseudocode)
def handle_request(request):
identity = authenticate(request)
policy = policy_for(identity, request.task)
tools = tools_allowed_by(policy)
with open_mcp_connection(policy.server_config) as client:
discovered = client.list_tools_sync()
selected = filter_tools(discovered, tools)
agent = Agent(tools=selected, model=configured_model())
return agent(build_prompt(request, identity, policy))The pseudocode intentionally leaves connection pooling, asynchronous execution, and model configuration to the framework and SDK version you use. Add cancellation so a disconnected client does not leave a long-running tool call behind, and set separate budgets for model generation and backend operations.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Design MCP tools as a small, explicit interface
Expose the minimum data
Prefer a tool that returns the fields needed for one task over a general database query tool. Apply tenant, role, and row-level filtering in the server or application policy layer. If a user needs order status, expose an operation that accepts an order identifier and returns status fields; do not expose unrestricted SQL simply because it is convenient.
Separate read and write operations
Give read-only tools distinct names and credentials from tools that create, modify, or delete data. A write tool should validate its input, return a preview or dry-run result where practical, and require an approval step for consequential or irreversible actions. The model can propose an action, but your application should decide whether that action is authorized.
Write descriptions for both humans and models
Document required fields, units, allowed values, side effects, failure conditions, and examples. Treat descriptions and annotations as untrusted unless they come from a server you trust. A persuasive description is not evidence that a tool is safe or that its implementation matches the description.
Rank #4
Use resources and prompts deliberately
Resources are appropriate for controlled context retrieval; prompts can standardize recurring workflows. Keep sensitive context out of prompts that do not need it, and mark provenance so the agent can distinguish authoritative records from user-provided text. If a server supports elicitation or sampling, define when your application may permit those client-side capabilities.
Free tools Windows power users keep installed
One-click scans. No signup required.
Apply security controls before production
The MCP security principles call for user consent and control, data privacy, and tool safety. They also recommend clear security documentation, robust consent and authorization flows, appropriate access controls, and data protections. The protocol cannot enforce these principles for you.
- Use trusted servers. Review source, maintainers, release history, dependencies, and deployment identity. Do not run an unknown server with production credentials.
- Use least privilege. Issue a credential scoped to the exact resources and operations required. Separate read and write identities and restrict network egress where possible.
- Keep authorization outside model discretion. Check the authenticated user, tenant, role, object ownership, and operation risk in application code before each consequential tool call.
- Require explicit approval. Confirm payments, deletions, permission changes, external messages, code execution, and other irreversible actions with the user or an authorized workflow.
- Validate inputs and outputs. Enforce schemas, size limits, allowed destinations, and type constraints. Treat tool output as untrusted data that may contain prompt-injection text.
- Protect private data. Minimize what is sent to the model, redact secrets, apply retention rules, and verify the provider’s data-handling terms for your deployment.
- Log safely. Record identity, tool name, decision, result status, latency, and correlation ID without storing secrets or unnecessary personal data.
- Test hostile cases. Include prompt injection in resources, forged tool instructions, malformed arguments, replayed approvals, server compromise, timeouts, and partial failures.
A useful approval record contains the user, exact tool, normalized arguments, affected resource, time, policy decision, and final result. Never treat a natural-language statement such as “the user approved this” as a substitute for a verifiable approval signal.
Choose between MCP, direct integrations, and different Strands layers
There is no universal winner; choose based on the boundary you need to maintain.
| Decision axis | MCP plus Strands Agents SDK | Direct, application-specific tool calls | Assembled agent harness |
|---|---|---|---|
| Agent-loop control | You configure the Strands loop and pass the tools that the agent may use. | You implement model messages, dispatch, retries, and state yourself. | More behavior is preassembled; verify which controls and extension points are exposed. |
| Integration boundary | MCP standardizes communication with independently managed servers. | Each backend gets a bespoke adapter and schema. | Depends on the harness’ supported connectors. |
| Language support | Strands documents Python and TypeScript; MCP servers can be implemented independently of the host language. | Usually tied to your application language and provider SDKs. | Use only the languages and providers documented by that product. |
| Security ownership | Your application still owns consent, authorization, credentials, and tool review. | Your application owns the same controls, but there is no protocol standard to reuse across adapters. | Read the harness’ security model; do not assume assembly removes your policy obligations. |
| Dependency risk | Track Strands, MCP package, transport, server, and provider compatibility. | Track your model SDK and each bespoke adapter. | Track the harness release and its transitive integrations. |
MCP is a good fit when several applications or agents need a consistent interface to the same approved capabilities. A direct integration can be simpler for one tightly controlled backend. Strands is useful when you want an SDK inside your process rather than a fully managed agent service.
Implement the TypeScript version without copying Python assumptions
Strands documents a TypeScript SDK with MCP support. The architecture is the same: create a client using a transport supported by your pinned SDK, connect to the reviewed server, enumerate or select tools, pass them to the Strands agent, and invoke the agent from your application’s request handler.
Best Value
- Follow the current TypeScript quickstart for package names, model-provider configuration, and the client constructor.
- Represent server parameters and environment variables in typed configuration.
- Use asynchronous connection, tool-listing, and invocation APIs in your route or worker.
- Map cancellation from the incoming request to model and tool operations.
- Apply the same identity, approval, least-privilege, and logging controls used by the Python implementation.
Do not infer that a Python transport helper, method name, or lifecycle pattern has an identical TypeScript spelling. Verify the current TypeScript reference for the release you install, then pin that release and test the complete connection path.
Validate compatibility and recover from common failures
The server starts but no tools appear
Check the command, arguments, working directory, environment, and server logs. Confirm that initialization and capability negotiation completed and that the server actually advertises tools rather than only resources or prompts. Test the server independently with the MCP client utilities documented for its release.
The MCP package and SDK disagree
Inspect the resolved dependency tree and compare it with the Strands README’s supported mcp major versions. If your server or internal extension still requires 1.x, use the documented mcp<2 constraint and lock it. Otherwise test the fresh 2.x resolution rather than mixing unpinned transitive versions.
Tool calls time out
Set separate connect, model, and tool deadlines. Return a clear retryable error for transient network failures, but do not automatically retry writes unless the operation is idempotent and you have a deduplication key. Cancel work when the client disconnects.
Credentials work locally but fail in deployment
Compare the runtime identity, region, environment variables, filesystem permissions, and network egress. Verify the model provider’s account and regional requirements and ensure the MCP server receives only the credentials it needs.
The model attempts an unsafe action
Do not fix this with a stronger system prompt alone. Remove or disable the tool for that policy context, enforce authorization before dispatch, require an approval record, and add a regression test containing the triggering request.
Test the whole path, not just the prompt
- Contract tests: verify tool schemas, required fields, permissions, and representative success and error responses.
- Connection tests: start the pinned server and confirm initialization, capability negotiation, and tool discovery.
- Authorization tests: attempt cross-tenant reads, unauthorized writes, expired approvals, and calls with altered arguments.
- Resilience tests: simulate server crashes, malformed JSON-RPC messages, slow backends, provider errors, cancellation, and duplicate requests.
- Prompt-injection tests: place hostile instructions in resources, tool output, and user input; confirm that policy checks still win.
- Evaluation tests: measure whether the agent chooses the right tool, asks for missing information, cites returned evidence appropriately, and declines unsupported claims.
Promote a server or SDK update only after rerunning these tests with the exact dependency lock file, model configuration, transport, and credentials class used in deployment.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A practical production checklist
- The use case, data scope, and allowed side effects are written down.
- Python or TypeScript, Strands version, MCP major version, transport, server release, and model provider are pinned.
- Only necessary tools are exposed, with separate read and write permissions.
- Authorization and approval checks run in application code before consequential calls.
- Secrets and personal data are minimized in prompts, logs, and model requests.
- Timeouts, cancellation, retries, idempotency, and partial-failure behavior are defined.
- Tool descriptions and server provenance have been reviewed as untrusted inputs.
- Connection, security, regression, and prompt-injection tests pass in CI.
- Operators can disable a server or tool quickly without redeploying the entire application.
With those controls in place, Strands supplies the in-process agent runtime while MCP supplies a consistent, negotiable interface to approved systems. Your software remains responsible for deciding what the agent may see and do.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
