Build a multi-agent system using ADK & MCP

Key Concepts

• ADK (Agent Development Kit): A framework for building production-grade, multi-agent systems.
• MCP (Model Context Protocol): A standard for connecting AI agents to external data sources and tools.
• Multi-Agent Orchestration: A hierarchical system where a "root" agent delegates tasks to specialized sub-agents (Critic, Recommender, Watchlist).
• Session State: Persistent memory that maintains context across different conversation turns.
• Instruction Templating: A method for dynamically injecting context (like user watchlists) into prompts at runtime.
• Defense-in-Depth Security: A layered approach using callbacks to validate inputs, outputs, and tool arguments.

---

1. Multi-Agent Architecture and Routing

The system, dubbed "Critiques Cut," utilizes a hierarchical structure managed by a Root Agent (the Director).

• Intent Detection: Instead of hard-coded if-else logic, the root agent uses LLM-based intent detection. Each sub-agent is defined with a specific description; the root agent reads these descriptions to route user queries to the most appropriate agent.
• Sub-Agent Roles:
  • Critic Agent: Handles movie reviews and data extraction.
  • Recommender Agent: Suggests movies based on user preferences and existing watchlists.
  • Watchlist Agent: Manages the persistent list of movies.

2. Real-World Data Integration (MCP)

The agent avoids static or API-dependent data by using the Model Context Protocol (MCP).

• Mechanism: The system connects to an mcp-server-fetch instance. ADK manages the lifecycle of this server as a child process.
• Process: When a user asks for a review, the Critic Agent constructs a URL (e.g., Rotten Tomatoes), uses the fetch tool to retrieve the raw HTML, and reasons over the content to extract live ratings and data.

3. State Management and Tooling

• Tool Creation: ADK automatically converts Python functions into tools by parsing signatures and docstrings.
• Type Safety: The developer uses Pydantic models to define structured inputs and outputs, ensuring validation and structured logging.
• Tool Context: A specialized ADK injection allows functions to access the session_state engine. This enables the watchlist to persist across different conversation turns without relying on global variables.

4. Security Framework: Defense-in-Depth

The system implements three distinct callback hooks to secure the pipeline:

1. Before Model Callback (Input Firewall): Uses deterministic Regex patterns to detect prompt injections (e.g., "ignore previous instructions"). This short-circuits the process, saving tokens and latency by refusing the request before it reaches the LLM.
2. After Model Callback (Output Filter): Scans the LLM’s response for PII (Personally Identifiable Information) like phone numbers or email addresses before the user sees the output.
3. Before Tool Callback (Argument Validator): Validates tool inputs (e.g., capping list size at 50, limiting title length to 200 characters) before the tool executes.

5. Context-Awareness via Instruction Templating

ADK uses curly-brace syntax within instructions to perform dynamic substitution at runtime.

• Example: The Recommender Agent’s prompt is updated with the user's current watchlist via the template. This ensures the agent is "context-aware," allowing it to explicitly avoid recommending movies the user has already saved, without requiring custom logic for every interaction.
• Global Instructions: A shared instruction set is appended to every agent in the hierarchy, ensuring consistent behavior (e.g., forcing Markdown formatting and restricting the scope to movies/TV).

6. Notable Quotes

• "You don't write if-else routing logic. The LLM handles intent detection using the descriptions you wrote."
• "Regex is deterministic... it's free. No API call, no token cost, no added latency. For known attack patterns, deterministic checks are the right choice."
• "Three callbacks, three insertion points, model input, model output, and tool input. That's the kind of layered security that moves a project from demo to production."

---

Synthesis

The "Critiques Cut" project demonstrates a shift from simple chatbot scripts to robust, production-ready agentic systems. By leveraging ADK and MCP, the developer creates a system that is not only context-aware and capable of real-time web research but also inherently secure through a layered callback architecture. The primary takeaway is that production-grade AI requires moving away from hard-coded logic toward deterministic guardrails (regex/validation) and dynamic context injection (templating), allowing the LLM to focus on reasoning rather than infrastructure management.