AI Agents & Tool-Use Interview Questions
AI agents — LLMs that use tools in a loop — are the hottest builder skill. Interviews cover function calling, ReAct, MCP, orchestration and reliability.
Interview questions & answers
Design an agent that resolves customer support tickets end-to-end. Walk through it.
Clarify scope: which actions (refunds, status, escalation), success metric, latency/cost budget. Tools with schemas: search_kb, get_order, issue_refund, escalate_to_human; RAG for policy answers. ReAct loop with step/cost caps; validate each tool result; answer from context with citations. Guardrails: human-in-the-loop for refunds above a threshold; treat ticket + retrieved text as untrusted (injection). Evals + tracing: golden tickets, task-success + tool-error rate; observability on every step.
Explain the ReAct loop and how an agent decides to stop.
Thought → Action (tool) → Observation, repeated; ends when the model emits a final answer instead of a tool call. Your runtime enforces hard limits (max steps, wall-clock, cost) to force termination. Add loop/progress detection (same tool + args repeated) to catch thrashing early.
What's the difference between a workflow and an agent, and why does it matter?
Workflow: fixed, known steps you coded (a chain). Agent: dynamic path the model chooses at runtime. Workflows are cheaper, faster, more reliable — use them whenever the path is known (if you can draw the flowchart, it's a workflow). Seniority = choosing the least-autonomous option that solves the problem.
How do you design tools so the model calls them correctly?
Clear name + description: what it does, when to use it and when NOT, with units/formats. Tight JSON schema: enums, required fields, types to constrain inputs; fewer degrees of freedom. Keep tools few and orthogonal; return concise structured results and errors as recoverable data.
How do you defend an agent that browses the web and can send email?
This is the lethal trifecta (private data + untrusted content + external comms) — cut a leg. Least-privilege tools; human approval before any send; allow-list recipients/actions. Treat page/tool content as data, not instructions (indirect prompt injection); sanitize/delimit tool outputs.
When is plain function calling enough, and when do you need MCP?
Function calling is enough when tools live inside one application you control. MCP shines when you want tools/data reusable across clients (Claude apps, IDEs, other agents) via a standard interface with discovery. They compose: MCP tools are surfaced to the model as function-calling tools — MCP standardizes where tools come from.
What does an MCP server expose and over what transports?
Primitives: tools (model-controlled actions), resources (app-controlled data by URI), prompts (user-invoked templates). Transports: stdio (local subprocess) and streamable HTTP (remote, supersedes HTTP+SSE). Building one: register a typed tool (SDK derives schema from signature + docstring), run a transport, enforce auth + least privilege.
Single agent vs multi-agent — how do you decide?
Default to the simplest: one well-tooled agent or a workflow. Go multi-agent only when the task's breadth exceeds one agent (distinct specialties, parallel subtasks, context that won't fit). Weigh the cost: multiplied latency, cost, and coordination failures (handoffs, context loss).
Name the main orchestration patterns and when you'd use each.
Router: classify and dispatch — cheap, robust first move. Plan-and-execute: draft a plan, execute (delegate steps), replan on new results — for complex multi-step tasks. Orchestrator–workers and handoffs for specialization; evaluator–optimizer for quality loops. Handoffs live or die on clean context transfer — pass minimal necessary state.
Compare LangGraph, OpenAI Agents SDK, Claude Agent SDK, CrewAI, and AutoGen.
LangGraph: explicit graph/state machine — max control, durability, inspectability. OpenAI Agents SDK / Claude Agent SDK: lightweight loops with tools, handoffs, guardrails, memory. CrewAI: role-based crews; AutoGen: conversational multi-agent. Show judgement: graph framework for control/durability, lightweight SDK for a fast standard loop.
Your agent sometimes loops forever or thrashes. How do you make it reliable?
Hard caps: max steps, wall-clock, cost; loop/progress detection. Validate every tool result; fewer autonomous steps (reliability compounds down). Prefer a workflow where steps are known; reserve agency for dynamic parts. Trace everything to see where it breaks; add idempotent retries + timeouts.
How do you evaluate an agent, offline and in production?
Evaluate the trajectory: expected tool-call sequence / final state, task success, steps, cost, latency, tool-error rate. Golden task set in CI; LLM-as-judge for open-ended outputs (validated against human labels). Online: success signals + human review + full tracing (LangSmith/Langfuse/Braintrust). Agents fail mid-run — one output score hides the cause.
How do you keep a production agent fast and cheap without wrecking quality?
Cap steps/tokens; route easy work to smaller models; cache repeated calls. Convert known paths to workflows; manage context (RAG + compaction) so windows stay small. Monitor cost/latency/success dashboards; version prompts/tools and roll out behind evals with a kill switch.
Your agent has 60 tools and their definitions alone eat 30% of the context window. Fix it.
First consolidate: few, orthogonal, workflow-shaped tools beat many API-shaped ones — most 60-tool agents are wrapping an API 1:1. Progressive disclosure / tool search: load tool definitions on demand instead of all up front. Code mode: have the model write sandboxed code that calls the tools, so intermediate results never hit the context — order-of-magnitude token cuts. Re-measure with your evals: tool-selection accuracy usually improves as the tool count drops.