Adding tools to an agent is easy. Adding too many is how you break it.
Connect a database, wrap an API, publish a server: exposure is a few lines of config. Past a certain count, the agent slows down and starts picking the wrong tool. Anthropic has documented the mechanism: tool definitions alone can consume tens of thousands of tokens before the agent begins working.
Three problems emerge at scale: what you expose, how agents find it, and who controls access.
Wrap capabilities, not raw infrastructure
The most common production mistake is exposing generic technical operations:
aws.amazon.com
