A single-loop agent with tools

Chapter 20 · goal + tools + loop

The hour

• An agent = goal + tools + bounded loop
• Every framework is layers over these three
• Tool safety + a hard step cap
• Memory is just state your tools mutate

The three pieces

• Goal — the system prompt: what it's for, how to behave
• Tools — what it can call
• Loop — run tool calls until the model answers

Build them once; the frameworks stop being magic.

Tools: capable AND safe

# whitelist operators via the AST — never eval()
_OPS = {ast.Add: operator.add, ast.Mult: operator.mul, ...}

An agent is only as safe as its worst tool.

The loop

for _ in range(max_steps):        # the safety rail
    response = complete(goal, history, tools)
    calls = tool_calls(response)
    if not calls: break            # no calls = the answer
    for c in calls:
        history += run_tool(c)

The step cap turns "got confused" into "got confused, cheaply."

The goal does real work

"Never do math in your head — use the tool."

Models compute confidently and wrongly. Good agent design is good instruction design.

Put it to work — three apps

• Calc agent — calculator + converter, chained
• KB agent — model-driven search (agentic RAG)
• Planner agent — a task list it mutates (memory)

Same loop; different tools + goal.

Two failure modes

• Tool-call loops — same call repeated → step cap saves you
• Silent wrong tool — log every call in dev

The loop makes agents powerful; logs make them debuggable.

Takeaway

Goal, tools, loop — write them by hand and frameworks read as convenience. Trust comes from safe tools, a step cap, forcing tools, and logging. Next: agents talking to agents.