# Deno agent architecture

An agent is not a special runtime. It is a loop of model decision, tool execution, result return, and stop evaluation. Deno's value is explicit permission around tools plus composable Web APIs, npm SDKs, MCP, and Sandbox boundaries.

## Choose the minimum complexity

| Need | Starting point |
| --- | --- |
| one model and a few function tools | vendor SDK and a short explicit loop |
| tools shared by several clients | MCP server |
| multi-provider graphs, tracing, integrations | evaluate LangChain.js / LangGraph |
| document indexing, RAG, data connectors | evaluate LlamaIndex.TS |
| model-generated code execution | Deno Sandbox, not plain `Deno.Command` |

Installing a framework through npm compatibility does not prove every integration works on Deno. Add smoke tests for the actual loader, vector store, native dependency, and streaming path before selection.

## Boundaries of a controlled loop

```text
user request
  → model (only approved tool schemas)
  → validate tool name and arguments
  → authorize or request human approval
  → run a time-bounded tool
  → return structured results
  → stop condition or maximum steps
```

- Set `maxSteps`, a total deadline, token or cost budget, and retry count.
- Tool handlers must not accept arbitrary shell, SQL, URL, or file paths.
- Separate read and write authority; deletion, payment, publishing, and production changes need explicit approval.
- Prompt injection can arrive through pages, databases, and MCP resources. Retrieved content is neither instruction nor authorization.
- Record tool name, argument summary, latency, result type, and error without logging secrets.

Continue with [OpenAI](/en/docs/ai/openai), [MCP server](/en/docs/ai/mcp-server), and [Deno Sandbox](/en/docs/ai/sandbox).