Production AI Agent Platform

Problem

A networking infrastructure company wanted users to operate the platform by asking for what they need instead of learning the console. That means an agent with real write access to production infrastructure, which is a very different problem from an agent that answers questions.

Architecture

A Node and TypeScript agentic loop built directly on the Anthropic API rather than on a framework. Roughly 43 MCP tools cover the platform surface.

Every tool is classified read or write. Read tools run. Write tools stop the loop, surface the exact mutation back to the user, and wait for explicit confirmation before anything executes.

Auth is delegated per user through OAuth2 with PKCE against Ory Hydra. Tokens are audience-bound per RFC 8707 and verified against JWKS, so a token minted for one service does not work against another. The agent acts as the user, with the user's permissions, never as a shared service account.

Responses stream to the client over GraphQL subscriptions on WebSocket. Deployed on ECS behind an ALB, with 80+ tests.

What's interesting

Owning the loop instead of importing one. A tool call that has to pause for human confirmation and then resume with full context is exactly where framework abstractions get in the way more than they help.

Audience binding matters more than it sounds. It is the difference between a delegated token and a bearer token that happens to work everywhere.

Status

Shipped. Contract work from July to September 2026, so the description here stays at the architecture level.