# Agents and MCP AI agents are language-model applications that answer questions and carry out tasks by calling tools; the Model Context Protocol (MCP) is an open standard for connecting agents to tools and data, including a data platform's catalog, semantic layer and query engine. > [!NOTE] > > **Before reading** > > [Semantic layer]() · [Authentication and authorization: OIDC and JWT]() ## Why it matters People increasingly ask questions of data in plain language, through assistants in chat tools, BI products and IDEs. An agent that can query the platform answers "how did sales do last week?" without a dashboard or an analyst. It is also a new consumer that writes its own queries, at any hour, on behalf of anyone. Whether its answers are correct and whether it respects access rules depends on how the platform is exposed to it. ## How it works An agent runs a loop. The user asks a question. The model decides which tool to call and with what arguments, the application calls the tool, the result goes back to the model, and the model either calls another tool or answers. The quality of the answer depends heavily on the tools: what they let the agent do, and how much meaning they carry. MCP standardises how tools are offered. An MCP server exposes tools (functions the agent can call, with a name, description and input schema), resources (data the agent can read, such as documentation) and prompts (reusable instructions). An MCP host, such as an assistant application, connects to servers through an MCP client. Servers run locally over stdio, or remotely over Streamable HTTP. Anthropic released MCP in November 2024; it is now governed by the Agentic AI Foundation under the Linux Foundation, and the latest specification is dated 28 July 2026 (checked October 2026). For a data platform, the choice of tools matters most. Giving an agent raw SQL against every table is easy and unreliable: it guesses joins, picks the wrong revenue column, misses that cancelled orders must be excluded, and writes expensive queries. Better tools carry the platform's knowledge with them: - search the business catalog for datasets, with descriptions and owners; - list metrics and dimensions from the semantic layer, and query a metric by dimensions; - read a table's contract or glossary terms; - run SQL only as a fallback, read-only, with limits. The agent must act as the user. Remote MCP servers that need to know the user use the spec's OAuth-based authorization: the user signs in, and the server receives a token that identifies them. The server must not forward that token; it exchanges it for a new token meant for the semantic layer or engine, still identifying the user, so that row filters, masks and grants apply exactly as they would to the user in any other tool. An agent running with a privileged service account would show every user everything that account can see. ``` sequenceDiagram participant U as User in assistant participant A as Agent (MCP host) participant M as Data MCP server participant S as Semantic layer U->>A: How did sales do last week? A->>M: list_metrics (user token) M-->>A: revenue, order_count, ... A->>M: query_metric(revenue, by day, last week) M->>S: Query as the user (token exchange) S-->>M: Daily revenue, EU rows only M-->>A: Results A-->>U: Revenue was EUR 1.21M, up 4% on the week before... ``` Guardrails limit damage. Tools are read-only unless writing is explicitly needed. Queries have row limits, timeouts and cost limits. Every tool call is logged with the user, the arguments and the result size. Data returned by tools is treated as untrusted: text stored in a table, such as a customer note, can contain instructions aimed at the model, called prompt injection, and must not be able to trigger other tools. ## Key terms - AI agent: a model-driven application that calls tools to answer or act. - Tool: a function an agent can call, described by name, purpose and input schema. - Model Context Protocol (MCP): an open standard for exposing tools, resources and prompts to agents. - MCP server: a service that exposes tools over MCP. - MCP host: the application in which the agent runs and connects to servers. - Prompt injection: instructions hidden in data that try to steer the model. - Acting as the user: calling downstream systems with the user's identity, not a service's. ## Example A regional manager in the EU asks the shop's assistant, "How did sales do last week?" The agent calls list\_metrics on the data MCP server, chooses revenue and order\_count, and calls query\_metric with the time range and a daily grain. The server exchanges the manager's token and queries the semantic layer as the manager. The layer applies the row filter region = 'EU'. The agent answers with EU revenue and order count per day, the change against the previous week, and a note that cancelled orders are excluded, taken from the metric's description. An analyst allowed to see all regions gets figures for each of them. In a multi-region setup these come from the aggregates each region publishes, as described in [Residency and regions](). Neither person could get more through the assistant than through the BI tool. ## Pitfalls - Raw SQL as the only tool. Answers depend on the model's guesses about tables and definitions. - A service account for every user. The agent bypasses row-level security. - Write tools without confirmation. An agent can change data or trigger actions based on a misunderstanding. - Trusting tool output. Text in data can carry prompt injection. - No logging. Wrong answers cannot be traced to the query that produced them. ## Learn more - Model Context Protocol specification: https://modelcontextprotocol.io/specification/ - OWASP, Top 10 for LLM applications (prompt injection): https://genai.owasp.org/llmrisk/llm01-prompt-injection/ ## Related [Embeddings, vector search and RAG]() · [Row-level security and masking]() · [Catalog and lineage]() · [Observability and SLOs]()