Deno agent architecture
Choose a controlled agent implementation across direct SDKs, MCP, LangChain, and LlamaIndex
An agent is not a special runtime. It is a loop of model decision, tool execution, result return, and stop evaluation. Deno's value is explicit permission around tools plus composable Web APIs, npm SDKs, MCP, and Sandbox boundaries.
Choose the minimum complexity
| Need | Starting point |
|---|---|
| one model and a few function tools | vendor SDK and a short explicit loop |
| tools shared by several clients | MCP server |
| multi-provider graphs, tracing, integrations | evaluate LangChain.js / LangGraph |
| document indexing, RAG, data connectors | evaluate LlamaIndex.TS |
| model-generated code execution | Deno Sandbox, not plain Deno.Command |
Installing a framework through npm compatibility does not prove every integration works on Deno. Add smoke tests for the actual loader, vector store, native dependency, and streaming path before selection.
Boundaries of a controlled loop
user request
→ model (only approved tool schemas)
→ validate tool name and arguments
→ authorize or request human approval
→ run a time-bounded tool
→ return structured results
→ stop condition or maximum steps
- Set
maxSteps, a total deadline, token or cost budget, and retry count. - Tool handlers must not accept arbitrary shell, SQL, URL, or file paths.
- Separate read and write authority; deletion, payment, publishing, and production changes need explicit approval.
- Prompt injection can arrive through pages, databases, and MCP resources. Retrieved content is neither instruction nor authorization.
- Record tool name, argument summary, latency, result type, and error without logging secrets.
Continue with OpenAI, MCP server, and Deno Sandbox.