Tools, browsers and service access in the agentic economy

On this page

Chapter 7 of The Hitchhiker's Guide to the Agentic Economy

Report hub · Previous: runtimes, orchestration and harnesses · In this chapter: the route ladder · market map · failure states · service access contract · Next: agent-to-agent coordination

The external effect boundary

Every external action an agent initiates crosses an interface operated by a third party.

In enterprise production, service access has divided into five distinct operational routes:

Direct APIs and function calls: Purpose-built, versioned endpoints exposing typed JSON schemas, deterministic validation, and auditable server receipts.
Model Context Protocol (MCP): A standardized client-server protocol enabling models to discover and invoke tools across compatible hosts, without settling counterparty trust or enterprise authority.
Managed connectors: Integration platforms that centralize OAuth consent, token refresh, and API routing across broad SaaS application catalogs.
Browser and computer use: Vision- and DOM-based automation platforms reaching legacy web applications lacking modern APIs, while inheriting visual drift, session volatility, and prompt-injection risks.
Packaged agent skills: Reusable instructional packages and scripts that guide tool utilization without granting new runtime credentials or authority.

The foundational security control across all five routes is the separation of proposal from execution. The foundation model selects an intended action and constructs parameter arguments. The host application, integration gateway, or headless browser worker validates those parameters and executes the network request.

OpenAI’s function-calling architecture separates model parameter generation from client-side execution (OpenAI, "Function calling"). Anthropic’s tool-use guidance enforces the identical boundary: Claude selects tool calls, but the host application executes the function and returns the result (Anthropic, "How tool use works"). Google’s Gemini API similarly places execution control within client software (Google, "Function calling"). The model proposes an action; the enterprise application governs whether that action occurs.

Key Takeaways

Direct APIs provide the clearest access contract when a service exposes stable, versioned operations and structured data.

MCP standardises discovery and invocation semantics. It does not certify provenance, uptime, security, pricing or permission.

A connector can shorten integration work and manage delegated credentials, while leaving scope, principal mapping, data path and effect policy with the customer.

Browser automation is a compatibility route, not a free substitute for an API. Pages, screenshots, selectors, cookies and login state remain changing and potentially hostile inputs.

A Skill is a package of behaviour, resources and instructions. Its effective authority comes from the tools and credentials available at runtime.

A production access route needs an explicit effect, idempotency rule, timeout, failure evidence and revocation path.

Five access routes in production architectures

Enterprises currently route agent actions through five complementary mechanisms:

The route begins with the capability the job must reach:
  |
  +-- Stable, versioned API with structured effect and receipt?
  |       +-- yes -> direct API/function call
  |
  +-- Common discovery and invocation needed for a compatible server?
  |       +-- yes -> MCP, after provenance/auth/tool review
  |
  +-- Many SaaS systems and delegated user accounts?
  |       +-- yes -> connector, after principal/scope/data-path review
  |
  +-- No reliable contract, but a website or desktop UI is available?
  |       +-- yes -> isolated browser/computer route, with confirmation
  |
  +-- otherwise -> human hand-off or build a stronger integration

  A Skill may sit beside any route as instructions and resources.
  It does not add credentials, permissions or a service effect.

No single interface standard dominates because each addresses a different segment of the enterprise software landscape:

Direct APIs provide deterministic reliability for core transactional workloads.
MCP standardizes dynamic tool discovery across multi-vendor developer tools.
Connector platforms eliminate custom integration code for broad SaaS suites.
Browser automation covers the massive long tail of legacy portals lacking programmatic interfaces.

Anthropic characterizes MCP as “an open standard connecting AI apps to tools and data” (Anthropic, "Claude can now connect to your world"). This accurately defines MCP’s role: standardizing the transport connection. It does not certify vendor security, verify counterparty uptime, or enforce least-privilege enterprise authorization.

The access route ladder

The access ladder orders integration routes from deterministic service contracts to fragile UI compatibility. Repeat, high-volume transactions cluster at the top; exception handling and legacy portals push down toward browser automation:

Priority	Operational question	Integration route	Primary technical advantage	Mandatory verification requirements
1	Does the service expose a stable, versioned operation with typed inputs and structured receipts?	Direct API or function call	Deterministic transport, strict input schemas, and service-enforced resource limits	Validating active authorization, enforcing idempotency keys, handling timeouts, and logging receipts
2	Does the capability require standardized tool discovery and invocation across diverse agent hosts?	MCP server	Standardized JSON-RPC protocol, dynamic tool discovery (`tools/list`), and structured schemas	Verifying server provenance, auditing tool schemas, enforcing OAuth scopes, and verifying resource policies
3	Does the workflow require connecting to multiple SaaS platforms using delegated end-user credentials?	Managed connector	Centralized OAuth token management, account linking, and normalized API schemas	Verifying token refresh/revocation hooks, mapping end-user identities, and auditing data retention
4	Is the external service accessible only via a web portal or desktop graphical interface?	Browser or computer use	Direct interaction with legacy UIs without requiring backend API access	MicroVM isolation, URL allowlisting, cookie management, DOM drift defense, and human confirmations
5	Is the service interface ambiguous, unstable, or beyond authorized security boundaries?	Human escalation or custom build	Absolute error containment, exception logging, and verified business delivery	Capturing failure evidence, routing to human review, and auditing total operational labor

Analyzing integration route standards

Direct APIs and function calling: the deterministic baseline

Direct APIs provide the most resilient commercial contract: operations are named, input parameters are strictly validated, error codes are explicit, and the receiving system enforces its own database permissions.

Function calling wraps direct APIs in model-facing JSON schemas. OpenAI’s strict mode enforces that model-generated parameters conform exactly to a supplied JSON Schema, while tool_choice governs whether tool invocation is mandatory or optional (OpenAI, "Function calling").

However, schema adherence does not ensure business validity. A parameter payload can be syntactically perfect while referencing an unauthorized customer account, an expired promo code, or an excessive spending limit. Server-side validation and authorization remain non-negotiable.

Direct APIs are optimal when the service provider satisfies five operational criteria:

Operations are versioned and required parameters are unambiguously typed.
Side-effects (database writes, financial charges, notifications) are clearly defined.
Successful completion returns an immutable resource receipt or transaction ID.
Duplicate requests can be safely processed via distributed idempotency keys.
Rate limits, session timeouts, and token revocation mechanisms are explicitly documented.

Model Context Protocol (MCP): standardizing connection, not counterparty trust

The Model Context Protocol establishes an open JSON-RPC specification allowing AI applications to connect with external tools and document repositories (MCP specification). The specification cleanly decouples the host application, MCP client runtime, and MCP servers. Servers expose resources, prompts, and tools via standardized primitives like tools/list and structured tool-call execution (MCP, "Tools").

These primitives provide essential interoperability. However, they do not resolve counterparty trust:

The specification explicitly notes that tool annotations and descriptions must be treated as untrusted unless the underlying server is verified.
Human confirmation and tool authorization remain the responsibility of the host client application.
OAuth token authorization is optional; implementations using it must validate tokens against the specific resource and audience (MCP, "Authorization").

An MCP server can achieve full protocol compliance while running unvetted code, leaking customer prompts, or suffering from severe service outages.

The official MCP Registry serves as a public metadata index of server identifiers and namespaces, pointing to independently maintained packages or remote endpoints (MCP Registry; registry quickstart). A registry listing confirms discoverability; it does not constitute a security audit, an enterprise uptime SLA, or verified commercial standing. Production deployment requires pinning specific server versions, auditing tool schemas, and enforcing strict network egress policies.

Managed connectors: centralized authentication versus control boundaries

Connectors abstract the complexity of integrating with dozens of third-party SaaS applications. Platforms like Pipedream, Composio, and Zapier manage OAuth handshakes, token refreshing, account linking, and API schema mapping (Pipedream, "Connect"; Composio, "Connected accounts"; Zapier, "MCP").

This reduces custom engineering overhead. However, it alters the enterprise security perimeter. An intermediary platform manages third-party credentials, while the enterprise buyer must still confirm:

Which internal employee identity authorized the third-party integration?
What exact OAuth scopes were granted to the connector service?
Does the connector retain or log customer data traversing its proxy?
How quickly does an account revocation propagate to active sessions?

A generic connector operation named update_record can carry radically different validation rules, side-effects, and failure modes across different target SaaS tools.

Headless browsers and computer use: the high-friction compatibility layer

Browser automation provides an access path for legacy applications lacking APIs. Deterministic libraries like Playwright use smart locators, auto-waiting, and structured retries against user-facing accessibility labels, providing resilience against minor DOM updates (Playwright, "Locators"). However, a changing commercial website remains an unstable software interface.

Vision-based computer-use models operate at a broader boundary: models inspect desktop screenshots or DOM trees, select coordinates, and execute mouse or keyboard actions. Documentation from OpenAI, Anthropic, and Google emphasizes identical operational boundaries: the host application must provide containerized isolation, enforce strict destination allowlists, treat screen content as untrusted data, and mandate human confirmation before executing consequential actions (OpenAI, "Computer use"; Anthropic, "Computer use tool"; Google, "Computer use").

The Australian Signals Directorate reinforces this architecture, emphasizing that the software harness surrounding the agent—its container isolation, credential boundaries, and monitoring—is the primary line of defense against prompt injection and malicious web content (ASD, "Agentic AI harnesses").

Cloud browser providers (Browserbase, Browser Use, Steel) package this infrastructure as a managed service, providing isolated Chromium containers, residential proxy networks, session recording, and profile management (Browserbase documentation; Browserbase cost optimization; Browser Use quickstart; Steel documentation).

Total operating cost in browser automation extends well beyond compute seconds: it encompasses multimodal inference costs, container runtime minutes, proxy bandwidth, video storage, CAPTCHA solving, ongoing selector maintenance, and human exception review. Furthermore, a screenshot confirming a button was clicked is not an authoritative receipt; commercial completion requires extracting a confirmation number, invoice PDF, or database record.

Packaged agent skills: distributable instruction sets

Agent skills package domain know-how into reusable bundles. OpenAI defines Skills as versioned instructions and supporting scripts executed within an isolated container (OpenAI, "Skills"). Anthropic models Skills as structured directories of prompts, scripts, and documentation that extend an agent's capability (Anthropic, "Skills guide").

Skills provide execution instructions: how to formulate complex SQL queries, call an API sequence, or handle domain-specific errors. They do not grant underlying system authority or create API credentials that the host environment lacks. OpenAI explicitly warns that Skills can influence multi-step planning and tool selection, requiring security inspection to prevent malicious instruction injection or data exfiltration.

The Model Context Protocol's Skills working group remains an early open-source incubation initiative, confirming that portable cross-platform skill standards are still developing (MCP Skills Working Group).

Who supplies service access infrastructure

The access ecosystem spans foundation model providers, open protocol consortia, automation libraries, and integration platforms:

Provider or platform	Documented access capability	Commercial access model	Adoption evidence boundary
OpenAI	Function calling, hosted remote MCP connectors, computer-use runtimes, and versioned Skills	Metered model token pricing, tool execution fees, and platform subscriptions	Documentation establishes callable surfaces; cross-industry production volume and accepted deliverable data are not published
Anthropic	Native client/server tool calling, remote MCP integrations, computer-use APIs, and Agent Skills	Usage-based model API pricing and enterprise cloud platform consumption	Official guides establish execution boundaries; cross-customer outcome rates remain private
Google Gemini	Function calling, managed tools (Google Search, Maps, Code Execution), and computer use	Direct API consumption and Vertex AI enterprise licensing	Documentation defines tool schemas; production reliability on complex enterprise tasks requires customer testing
MCP Specification & Registry	Open JSON-RPC tool discovery, standard schemas, and public registry metadata	Open-source MIT specification; preview metadata catalog	Specification confirms technical interoperability; registry presence does not verify server security, uptime, or commercial quality
Playwright	Programmatic browser automation, auto-waiting locators, and isolated browser contexts	Open-source Apache-2.0 library; customer provisions compute infrastructure	Package availability confirms automation mechanics; does not guarantee third-party website stability or anti-bot pass rates
Browserbase, Browser Use, Steel	Managed cloud browser sessions, residential proxy integration, video capture, and session APIs	Metered container runtime minutes, proxy bandwidth, and enterprise plan tiers	Documentation confirms available infrastructure; does not prove successful task completion across complex third-party portals
Pipedream Connect	Managed OAuth token lifecycle, connected accounts, and MCP server bridges	Tiered platform subscriptions and per-task compute consumption	Features establish authentication handling; does not verify downstream business logic or ERP reconciliation
Composio	Multi-tenant account authentication, token vaults, server-side injection, and execution tools	Managed integration platform with usage-based task pricing	Documentation confirms token isolation; does not guarantee consistent semantics across disparate third-party APIs
Zapier MCP	Natural-language interface to Zapier's extensive SaaS app integration catalog	Subscription plans based on task volume and connected application limits	Confirms broad connector catalog; does not prove workflow portability or enterprise least-privilege scoping

Catalog size, connector counts, and registry listings measure product supply. Enterprise adoption is measured by production task completion, error recovery rates, and fully loaded unit economics.

Operational flow and failure states

Executing external actions requires an explicit state machine:

job objective and acceptance test
  -> choose route and pin provider/server/version
  -> resolve principal, credential and allowed effect
  -> discover or load only the permitted operation
  -> validate input and approval requirements
  -> invoke through API, MCP, connector or browser session
  -> receive result, receipt and evidence
  -> reconcile the resource state
  -> accept, retry safely, compensate or hand off

Production run records must capture eleven distinct operational failure states:

Failure state	Operational meaning	Required system response	Retained audit evidence
Discovery failed	Target server, connector, or endpoint is unreachable, or advertised tool schemas changed	Halt execution; prohibit automated substitution of similarly named tools	Registry lookup record, endpoint URI, tool schema hash, error payload
Authentication failed	API credentials missing, expired, revoked, or rejected (HTTP 401/403)	Suspend task; escalate to human credential owner; prohibit blind retries	Sponsoring principal ID, credential scope, issuer ID, provider error code
Schema invalid	Parameter arguments violate the target tool's declared JSON Schema	Reject request before execution; trigger deterministic schema repair or escalation	Input/output schema, malformed payload, validator error, execution status
Approval denied / Out of policy	Required human authorization missing, or requested action breaches budget/scope limits	Hard stop; require explicit human re-authorization before re-submitting	Approval request digest, policy engine version, denial timestamp and reason
Rate limited / Unavailable	Upstream provider returns 429 Too Many Requests or 503 Service Unavailable	Apply exponential backoff with jitter for read-only calls; flag writes as unknown	HTTP response headers (`Retry-After`), attempt count, idempotency key
Transport timeout	Connection drops mid-request; client cannot determine if write committed	Transition task to `needs_reconciliation`; query provider status before retrying	Request ID, deadline timestamp, connection log, status query result
Browser session lost	Headless container crashed, cookies expired, or worker process was terminated	Halt execution; discard unverified DOM state; re-authenticate via approved flow	Session ID, container log, last verified URL, DOM checkpoint, termination code
UI structure drift	Website layout, DOM selectors, or navigation elements altered by target site	Suspend run; route to developer maintenance; prohibit speculative clicking	Target URL, selector path, visual screenshot, DOM diff, error trace
Adversarial injection detected	Retrieved web content or tool output contains prompt injection attempts	Treat content strictly as data; isolate context; halt write actions; alert security	Content source URL, extracted injection payload, blocked tool action
Ambiguous partial result	Upstream service returns incomplete data or reports partial batch success	Reconcile resource state against provider database; route discrepancy to review	Provider transaction receipt, partial data payload, reconciliation log
Mid-flight revocation	Principal authority, API token, or session lease revoked during active execution	Cancel in-flight jobs immediately; terminate container leases; contain side-effects	Revocation event timestamp, propagation trace, terminated container IDs

The highest-consequence failure is an ambiguous write following a network timeout. Systems must record that an external action's status is unknown, pausing execution until the real-world effect is verified.

Commercial models across access routes

Total operating expenditure across access routes extends well beyond the raw API invocation price:

Integration route	Primary commercial charging unit	Hidden operational cost drivers
Direct API	Per-request fees, token consumption, compute tiers, or volume commits	Custom integration engineering, API version migration, rate-limit capacity, error handling
MCP server	Self-hosted compute infrastructure or managed server subscriptions	Server hosting, container maintenance, tool schema reviews, security patching, registry audits
Managed connector	Tiered platform subscriptions, connected-account fees, or per-task usage	Upstream provider tier costs, data transfer fees, connector outages, vendor lock-in
Browser / Computer use	Container runtime minutes, active proxy bandwidth, and storage fees	Model vision tokens, CAPTCHA bypass services, visual maintenance, manual failure reviews
Packaged skill	Bundled within model subscriptions or licensed as proprietary IP	Security code audits, container sandboxing, prompt maintenance, tool dependency reviews

The controlling economic metric is fully loaded cost per accepted deliverable: combining inference tokens, tool fees, container minutes, maintenance engineering, and human exception review against accepted business volume.

The Service Access Contract

Production systems require an explicit operational contract governing each third-party integration boundary:

Contract parameter	Architectural requirement
Capability and scope	Clear definition of the business task, target endpoints, and explicitly prohibited actions
Ownership and endpoints	Accountable business owner, technical provider, canonical API URL, MCP server identity, or website origin
Interface specifications	Pinned API version, MCP protocol version, connector release ID, and container image digest
Input constraints	Strict JSON Schemas, data type boundaries, and explicit rules prohibiting unvalidated web inputs
Output verification	Expected response schemas, immutable transaction receipts, and explicit acceptance tests
Credential scoping	Sponsoring principal ID, least-privilege OAuth scopes, token lifetimes, and isolated vault storage
Permitted side-effects	Whitelisted read, write, update, and financial charge permissions; hard block on unlisted actions
Policy enforcement	Explicit human approval gates for high-consequence actions, validated against formal policy engines
Idempotency rules	Unique, distributed idempotency keys and designated query endpoints to verify ambiguous writes
Execution timeouts	Strict network deadlines, container keep-alive limits, and maximum retry windows
Error remediation	Explicit matrix categorizing errors into safe retries, mandatory reconciliations, and hard stops
Audit evidence	Mandatory logging of correlation IDs, request/response payloads, DOM checkpoints, and timestamps
Data governance	Regional data processing boundaries, zero-retention compliance, and verifiable data disposal logs
Revocation mechanisms	Instant token revocation hooks, active session termination APIs, and in-flight cancellation rules
Contractual recourse	Designated liability for service outages, corrupted database writes, and formal dispute procedures

Evaluating access evidence

Enterprise IT and security teams evaluate service access claims by testing failure modes directly:

Evidence source	What it establishes	Unresolved operational question
Direct API / Schema	Documented parameter formats, endpoints, and server return types	Whether generated arguments are business-appropriate or authorized
MCP specification	Standardized JSON-RPC message schemas and discovery protocols	Server operational security, code safety, uptime SLAs, or commercial terms
MCP Registry entry	Public metadata, package namespace, and endpoint pointers	Uptime reliability, security posture, data privacy, or active enterprise usage
Connector documentation	Supported SaaS applications, OAuth workflows, and normalized endpoints	Correct mapping of corporate identities, least-privilege scoping, or portability
Browser framework docs	Locators, container virtualization, and session management mechanics	Target website DOM stability, CAPTCHA resilience, or transactional integrity
Skill package repository	Bundled instructional markdown, scripts, and suggested tool mappings	Underlying system permissions, API access keys, or guaranteed task success
Published pricing page	Nominal metering units and published software subscription tiers	Net fully loaded operating cost per successfully accepted business deliverable

The trajectory of service access

The market is organizing into a stable access hierarchy:

Direct APIs remain the standard for high-volume, mission-critical transactions where partners expose versioned endpoints.
MCP is consolidating developer-facing tool discovery and dynamic function execution across compatible AI applications.
Connector platforms maintain an enterprise distribution role by aggregating legacy SaaS authentication.
Headless browser infrastructure serves as the universal compatibility adapter for un-API'd portals, bounded by strict isolation sandboxes and human approval checkpoints.
Skills package procedural know-how across all four routes without altering underlying system authority.

The decisive competitive boundary is shifting from raw connector catalog counts to verifiable authority governance, immutable audit evidence, and rapid failure remediation.

Every service access route described here connects an agent to a software interface. Chapter 8 examines the next coordination boundary: when an agent delegates work not to a passive API, but to another autonomous agent operated by an independent third party.

Sources and method

Primary sources: Technical specifications, developer documentation, and API guides from OpenAI, Anthropic, Google Cloud, Model Context Protocol, Playwright, Browserbase, Browser Use, Steel, Pipedream, Composio, and Zapier checked as of 13 September 2026.
Analytical frameworks: The Access Route Ladder, the eleven-state access failure matrix, and the Service Access Contract are original analytical structures developed to evaluate tool execution governance.
Evidence boundaries: Documentation establishes declared API parameters, protocol schemas, and commercial pricing. Production uptime, prompt-injection resilience, and end-to-end task reliability require empirical validation on customer workloads.
Institutional references: Cyber-security guidance from the Australian Signals Directorate (ASD) establishes operational baselines for securing agent harnesses and external tool boundaries.
Editorial record: Published by Agentic Economy, Perth, Western Australia. Updates and corrections are logged via the editorial record.

Back to the report hub · Next: agent-to-agent coordination.