AI agent interview questions, answered the way you’d say them.

When the steps are known in advance. Anthropic defines workflows as LLMs and tools orchestrated through predefined code paths, and agents as systems where the model directs its own process and tool use. Workflows such as prompt chaining or routing are predictable and easier to test; agents suit open-ended tasks whose steps can’t be planned, at the cost of latency, money and compounding errors. Start with the simplest design that works.

Be ready to name the five workflow patterns: prompt chaining, routing, parallelisation, orchestrator-workers and evaluator-optimiser.

Anthropic Engineering, Building effective agents (2024)

Practise it with Prism

The loop ends when the model replies with an answer instead of a tool call; Claude, for example, returns stop_reason “tool_use” while it wants a tool run. Because models can loop, add hard limits: a maximum number of turns (OpenAI’s Agents SDK raises MaxTurnsExceeded), a token or cost budget, a wall-clock timeout and a check for repeated identical calls. When a limit trips, stop cleanly and hand the log to a person.

Check your framework’s default: LangGraph’s recursion limit is 10,007 steps from version 1.1.4, far more than most tasks should need.

Claude API docs: Tool use with ClaudeOpenAI Agents SDK: Running agentsLangGraph: Graph API overview (recursion limit)Anthropic Engineering, Building effective agents (2024)

Practise it with Prism

Describe the tool as you would to a new colleague: what it does, when to use it and when not, and what it returns. Use unambiguous parameter names such as user_id, a JSON Schema with required fields, and return compact, readable results with errors the model can act on. Prefer a few tools built around real tasks over wrapping every API endpoint, and namespace them so similar tools aren’t confused.

track_order = {                                  # Anthropic Messages API format
    "name": "orders_track",
    "description": "Get the delivery status of one order. Use only when the customer "
                   "gives an order ID; never guess one. Returns status and expected date.",
    "input_schema": {
        "type": "object",
        "properties": {"order_id": {"type": "string", "description": "Order ID, e.g. OD123456"}},
        "required": ["order_id"],
    },
}

Report a failed call as a result the model can read, such as “order not found: ask the customer to check the ID”; MCP does this with isError set to true.

Anthropic Engineering, Writing effective tools for AI agents (2025)Claude API docs: Tool use with ClaudeModel Context Protocol specification (2026-07-28): Tools

Practise it with Prism

MCP standardises how an AI application connects to tool and data servers: JSON-RPC 2.0 messages over stdio or Streamable HTTP, capability negotiation, and three server primitives with clear control: tools the model calls, resources the application attaches and prompts the user picks. It doesn’t decide what your tools may do: the specification says MCP can’t enforce security at the protocol level, so consent, authorisation, input validation and rate limits are your job.

Know the version: the 2026-07-28 revision made every request self-contained, carrying its protocol version and capabilities, instead of relying on a connection-level handshake.

Model Context Protocol specification (2026-07-28): OverviewModel Context Protocol specification (2026-07-28): Server featuresModel Context Protocol specification (2026-07-28): Transports

Practise it with Prism

Each tool is declared with its name, what it does, and a JSON Schema describing its inputs. The model responds with a call to one of them, my code executes it, and I send the result back; MCP tools are described the same way. Structured output gets validated, never trusted blindly, for example with a Pydantic model, and if validation fails I retry, passing back the error message, or hand it to a person.

Model Context Protocol: Architecture overview

The full answer, in the guidePractise it with Prism

A RAG chain follows fixed steps, retrieve and then answer, whereas an agent runs a loop. At each turn the model chooses the next action, such as calling a tool, searching or asking the user, looks at the result and goes again until the task is done, which is the pattern ReAct described: reasoning interleaved with actions. That makes agents good at open-ended tasks, but they need logs, step limits and tool permissions.

Be ready to sketch the loop yourself in plain Python, with a step limit.

Yao et al. 2022: ReAct

The full answer, in the guidePractise it with Prism

The Model Context Protocol is how AI applications connect to outside systems. A host, like an IDE or a chat app, runs one client for each server, and servers expose three primitives, tools, resources and prompts, and talk over either stdio or Streamable HTTP. Pasting API docs costs tokens on every call and executes nothing, whereas an MCP server is written once, plugs into any MCP host and holds the credentials server-side.

A classic bug: a server on the stdio transport must never write to stdout.

Model Context Protocol: What is the Model Context Protocol?Model Context Protocol: Architecture overviewModel Context Protocol: Build an MCP server

The full answer, in the guidePractise it with Prism

I’d pick by need, and show I could write the loop myself. A plain chain is enough when the steps are fixed. LangGraph, a low-level framework built for long-running, stateful agents, suits human approval, checkpoints and loops, while multi-agent frameworks are for getting several specialised agents to work together.

Interviewers care more about how you handle state, retries and evaluation than about which library you pick.

LangChain: LangGraph overview

The full answer, in the guidePractise it with Prism

Mostly it runs a loop you could write yourself. It turns your Python functions into tool schemas from their names, docstrings and type hints, sends those with the conversation to the model, parses any tool calls in the reply, runs the functions, appends the results as messages, and calls the model again until it answers without a tool call. Around that loop it adds state and memory, retries, streaming, tracing and ways to combine agents. Knowing the loop lets you debug the framework, or do without it.

The docstring becomes the description the model reads, so a vague docstring leads to wrong tool choices.

Google Agent Development Kit: Function toolsLangChain: Tools

Practise it with Prism

The host application runs an MCP client for each server. The client sends tools/list, and the server returns each tool’s name, description and a JSON Schema for its inputs, which the host passes to the model. When the model chooses a tool, the client sends tools/call with the name and arguments, ideally after a person approves; the server runs it and returns content, with isError set if it failed, so the model can correct itself. The host adds the result to the conversation, and the model carries on.

In the 2026-07-28 revision there’s no protocol-level session: each request carries its protocol version and client details in _meta, so a stateful tool must return an explicit ID for later calls.

Model Context Protocol specification (2026-07-28): Tools

Practise it with Prism

A router classifies each request and sends it to the agent, prompt or model best suited to it. That keeps each agent’s instructions and tools small and focused, since tuning one agent for every kind of request tends to make it worse at some of them, and it lets you test and improve each route separately. It also saves money: Anthropic suggests sending easy, common questions to smaller, cheaper models and hard ones to more capable models. The router can be rules, a classifier or an LLM, with a fallback.

Measure the router itself: a misrouted request fails however good the agent behind it is.

Anthropic Engineering, Building effective agents (2024)

Practise it with Prism

Only if the operation is idempotent. A timeout doesn’t tell you whether the payment went through, so a blind retry can charge twice. Send an idempotency key that stays the same across retries, so the server returns the first result instead of repeating the action, as Stripe’s API does; reads, PUT and DELETE are idempotent by HTTP’s definition. Retry with capped exponential backoff and jitter so that clients don’t retry in lockstep.

import random, time, uuid
def call_with_retries(tool, args, attempts=4, base=0.5, cap=8.0):
    key = str(uuid.uuid4())                        # the same key on every retry
    for attempt in range(attempts):
        try:
            return tool(**args, idempotency_key=key, timeout=10)
        except TimeoutError:
            if attempt == attempts - 1:
                raise                              # give up and escalate
            time.sleep(random.uniform(0, min(cap, base * 2 ** attempt)))   # backoff with jitter

Set each tool’s timeout from the downstream service’s latency percentiles, as AWS describes (for example p99.9), not from a guess.

Stripe API reference: Idempotent requestsRFC 9110, HTTP Semantics, section 9.2.2: Idempotent MethodsAmazon Builders' Library: Timeouts, retries and backoff with jitter

Practise it with Prism

Apply least privilege, assuming injected or hallucinated instructions will reach it. OWASP’s excessive agency guidance lists the levers: offer only the tools the task needs, narrow each one (read-only where possible), avoid open-ended tools such as a shell, act with the user’s own narrowly scoped credentials, require human approval for high-impact actions, and enforce authorisation in the downstream system, not in the model. Logging and rate limits then contain any damage.

OWASP’s example: an email assistant meant only to summarise could also send mail, so an injected email made it forward private messages; a read-only scope would have stopped it.

OWASP Top 10 for LLM Applications 2025: LLM06 Excessive Agency

Practise it with Prism

Score outcomes, and score them repeatedly. Build realistic tasks in a sandbox and check the end state, such as the database after the conversation, rather than the exact steps, as τ-bench does. Agents are non-deterministic, so run each task several times and report pass^k, the chance of succeeding on all k tries: on τ-bench, GPT-4o solved under half the tasks and its retail pass^8 was below 25%. Track cost, steps and policy breaches too.

The simulated customer is part of the test: τ-bench uses a language model to play the user, so check that it behaves realistically too.

Yao et al., τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains (2024)

Practise it with Prism

A LangGraph graph passes a shared state between nodes, and each state key has its own reducer, which decides how a node’s update merges in: by default the new value replaces the old, while add_messages appends new messages and updates those with a matching ID, so the conversation accumulates. For approval, call interrupt() inside a node: a checkpointer saves the graph’s state, the run pauses, and you resume with Command(resume=...), whose value becomes interrupt()’s return value. LangSmith records traces of each run for debugging.

Put the interrupt just before the risky action, such as a payment or a database write, so a person can approve or edit the tool call.

LangGraph: Graph API (state and reducers)LangGraph: InterruptsLangSmith: Observability

Practise it with Prism

Make the tool result the source of truth. Tools should return an explicit status: an order ID on success, or an error the model can read, which Claude’s API marks with is_error and MCP with isError, rather than failing silently. Have code, not the model, build the confirmation from the tool’s structured result, or check the model’s message against it before sending. After a timeout, look up the order’s status before replying or retrying. Then test it by injecting tool failures into your evaluations, and alert on mismatches.

Never let the model invent an order ID: if one appears in a reply but in no tool result, block the message.

Claude API docs: Handle tool calls (is_error)Model Context Protocol specification (2026-07-28): Tools (error handling)

Practise it with Prism