Integration

Knowledge of

• Capability bloat as the risk of giving an agent more or stronger tools than its role requires, harming security, reliability, and cost
• The principle of least privilege by removal: eliminating unneeded capabilities entirely rather than guarding them with logging or confirmation prompts
• How growing tool sets and overlapping descriptions reduce tool selection accuracy as the set grows
• The distinction between detective/compensating controls (audit logs, confirmation prompts) and controls that actually shrink the attack surface (removal)
• That model size or instruction-following ability is unrelated to authorization scope

Skills in

• Auditing an agent's configured tool set against its actual role to identify capabilities it does not need
• Removing unneeded or overly powerful tools from an agent's configuration rather than adding logging or confirmation prompts around them
• Distinguishing genuine least-privilege fixes from detective/compensating controls when evaluating a proposed remediation
• Weighing the security, reliability, and cost/context implications of every tool exposed to an agent

Knowledge of

• Authentication as proving who is calling (API keys, OAuth, service identities) versus authorization as deciding what that identity may do
• The confused-deputy risk: an agent acting with broad service credentials on behalf of a low-privilege user can leak or change data the user should not be able to touch
• Scoping tool permissions to the calling user's entitlements rather than the service's broader credentials
• Secrets management practices: credentials belong in environment variables or a secret store, never hard-coded, committed, or placed in prompts

Skills in

• Analyzing an integration for authn/authz gaps before it ships
• Scoping tool and data access to the calling user's entitlements to prevent confused-deputy scenarios
• Verifying that every hop — Claude to tool, tool to downstream service — authenticates its caller
• Identifying hard-coded, committed, or prompt-embedded secrets as a design flaw and moving them to environment variables or a secret store

Knowledge of

• Chunking: splitting source documents into retrievable units sized to match data shape and query pattern, since chunks that are too large dilute relevance and chunks that are too small lose needed context
• Indexing/retrieval methods — embedding/semantic search, lexical BM25, hybrid, and reranking — and the relative strength of each
• Contextual retrieval: prepending a short chunk-specific context blurb before embedding and indexing so an isolated chunk retains the surrounding document context it would otherwise lose
• The full RAG pipeline order: ingest, chunk, add context, embed and index (vector plus lexical), retrieve, rerank, assemble context, generate
• Prompt caching as the mechanism that makes generating per-chunk contextual blurbs economical at scale

Skills in

• Selecting chunk size and boundaries appropriate to the source data's shape and the expected query pattern
• Combining embedding and BM25 retrieval (hybrid) and adding a reranking step to reduce retrieval-failure rates versus naive embedding-only RAG
• Applying contextual retrieval (contextual embeddings plus contextual BM25) to prevent chunks from losing surrounding document context
• Recognizing when a larger context window is being used as a substitute for retrieval, and correcting course toward targeted retrieval instead

Knowledge of

• That retrieval strategy should be matched to data shape and query pattern rather than defaulting to one favorite technique
• When to query a structured/tabular source of truth directly (SQL/API) instead of embedding it
• When lexical/BM25 outperforms semantic search (exact identifiers, codes, names) versus when semantic embeddings are preferred (natural-language, paraphrase-heavy queries)
• When a small, stable reference set is better placed in a cached prompt prefix than built into a full retrieval pipeline

Skills in

• Matching retrieval strategy — direct query, lexical, semantic, hybrid, or cached prefix — to the shape of the underlying data and how users phrase queries
• Recommending direct source-of-truth queries over embedding for structured/tabular data with precise lookups
• Choosing hybrid retrieval for mixed corpora spanning exact identifiers and natural-language questions
• Evaluating whether a small, stable reference set is cheaper to cache than to retrieve

Knowledge of

• MCP (Model Context Protocol) as an open standard exposing tools, resources, and prompts to any MCP client, authored once and reused across applications
• Direct API/CLI integration as the fit for one-off, app-specific integrations where a standard protocol adds no leverage
• Agent-to-agent delegation as the fit when the remote capability is itself an autonomous agent rather than a single function
• MCP transports: stdio for local subprocesses, Streamable HTTP/sockets for remote, multi-client servers

Skills in

• Selecting MCP, direct API/CLI, or agent-to-agent delegation based on a capability's reuse and maintenance profile
• Recognizing when MCP is being reached for a single app-specific call, or a direct integration is being hand-rolled for a capability many apps will share
• Choosing the appropriate MCP transport (stdio vs. Streamable HTTP) for local versus remote, multi-client scenarios

Knowledge of

• Monolithic context: front-loading all tools, schemas, and docs into the context window up front
• Progressive discovery: exposing a lean surface and letting the agent fetch detail on demand
• The cost of monolithic context at scale: context bloat, higher cost, and context rot, with most loaded content unused on any given request
• That progressive discovery is the scalable pattern for large integrations, while monolithic context is acceptable only when the full set is small and stable

Skills in

• Designing agent-environment interfaces that expose a lean surface with on-demand detail fetching for large tool/resource sets
• Recognizing when a monolithic, front-loaded context design will not scale and recommending progressive discovery instead
• Applying the same context-curation discipline used elsewhere in agent design to tool/resource exposure decisions

Knowledge of

• What to log and trace for production integrations: request/response pairs, tool invocations and arguments, retrieval hits, stop_reason, and per-hop token usage
• Tracing multi-step runs to walk a failure back to its first deviation
• Scaling observability with sampling, structured logs, latency/error dashboards, and per-domain quality metrics to catch regressions
• The accuracy-latency-cost tradeoffs of common integration levers: reranking, retrieved-chunk count, prompt caching, and model size
• Tying each optimization decision to the stated accuracy/latency/cost requirement rather than optimizing a constraint the SLA does not require

Skills in

• Instrumenting an integration with logging/tracing of tool calls, retrieval hits, stop_reason, and token usage
• Diagnosing confident-but-wrong output that appears after a document refresh by investigating the retrieval/indexing step first
• Justifying accuracy-latency-cost tradeoffs (reranking, chunk count, caching, model size) against a stated constraint
• Detecting regressions such as a broken re-index or model-version drift using dashboards and quality metrics before users report them