Agents, Tool Use and MCP for CCDV-F: The 25% Guide [2026]

Add the CCDV-F domains for agents (15%) and tools with MCP (10%) and you get a quarter of the exam built on one architecture: a model that requests actions, your code that executes them, and a protocol that standardizes how tools plug in. Candidates who have shipped an agent loop find these questions almost free; candidates who have only read about agents lose them to bookkeeping details, because the exam tests the loop at the level where bugs live: whose job execution is, what gets appended where, which transport fits which deployment, and what actually stops a hostile input. This guide builds the stack the way the exam examines it, with the traps marked.

The tool-use loop, with the bookkeeping

Claude does not execute anything. That sentence grades several questions per exam. When you pass tool definitions (name, description, typed input schema) with a request, the model may respond with a tool-use block: the tool's name and arguments, plus a stop reason saying it paused to await a result. Your code then executes the function locally, appends the result to the conversation as a tool-result message, and calls the API again; the loop continues until the stop reason says the turn is complete.

The graded details are exactly the ones that break real loops: the tool result must be appended to history (forget it and the model re-requests the same call, the classic broken-loop stem); execution, sandboxing, and timeouts are your code's responsibility; parallel tool calls can arrive in one response and each needs its result; and loop termination deserves a guard (a maximum iteration count) so a confused agent cannot spin forever. If you build one honest loop before exam day, every one of these becomes recognition instead of recall; the agent loop task grades that exact build with safe termination as a rubric line.

Raw loop or Agent SDK: the altitude question

The exam expects you to know both layers and when each is the answer. The raw Messages-API loop gives full control and full responsibility: your retries, your state, your termination logic. The Agent SDK runs the loop for you, with built-in tools (file operations, command execution), subagent spawning, and session management, which makes it the graded answer when a stem describes wanting agent capability without rebuilding plumbing, and the wrong answer when a stem needs tight custom control of every step. The discriminator is what the scenario says the team is struggling with: loop mechanics point at the SDK; unusual control requirements point at the raw loop.

Subagents earn their questions through context: a subagent runs with its own isolated context window and returns a summary, which is the graded fix for "one agent's context fills with exploration debris" and the mechanism behind parallel work. Headless operation (running the agent non-interactively with machine-readable output) shows up as the CI answer, and it is the same capability the review-bot task has you ship.

MCP: scopes, transports, and where credentials live

The Model Context Protocol standardizes how tools and data sources connect to a model-driven client, so integrations are written once against the protocol instead of once per client. The exam asks it at deployment altitude, and two axes carry the points:

Transport matches deployment. A server running beside the client as a subprocess speaks stdio; a server deployed centrally for a team speaks streamable HTTP. A stem describing both in one scenario is testing whether you assign each correctly, and remote servers bring web-grade auth (OAuth flows) where local ones inherit the local environment.

Scope matches trust. Server configurations live at different scopes (personal, project-shared, organization-managed), and secrets belong in environment references, never committed configuration. The graded instinct on any MCP security stem is least privilege: the narrowest scope, the fewest permissions, the credentials outside the file.

Guardrails: what survives a hostile input

The security overlap with the agent domains produces the exam's most reliable question family: how do you stop an agent from doing something destructive? The graded taxonomy has three layers, and only two of them count as enforcement. Permissions decide what the agent may do at all (allow-lists, denied commands). Hooks are your code intercepting actions at lifecycle points, inspecting the actual command or edit before it executes, and blocking on your logic; a hook cannot be persuaded, which is the whole point. System-prompt instructions are behavior shaping, valuable for quality, and the designated wrong answer for safety, because a prompt injection defeats a request but does not defeat code. When a stem offers "add a rule to the system prompt" beside "add a hook that blocks the command," the exam is checking whether you know which one survives contact with hostile input. The hardening task makes this concrete: a permission set, a skill, and a hook that provably fires.

Worked scenario: the loop that spins

A developer's agent calls the weather tool, receives the result in their application logs, and then calls the same tool again with identical arguments, forever. The tool executes correctly and the response is well-formed. What is broken?

The result never made it back into the conversation. Logging it is not appending it: the model's next turn sees a history in which its tool request was never answered, so it asks again, which is exactly correct behavior from its side of the contract. The fix appends the tool-result message tied to the request, and the loop completes. Distractors offer iteration caps (masks it), different models (same contract), and longer timeouts (nothing timed out). The tell is "identical arguments, forever": memory is missing, and history is the agent's memory.

Worked scenario: one protocol, two deployments

A team ships an MCP server for internal ticket search. Developers run it locally beside Claude Code; the infrastructure team also hosts it centrally so CI agents and teammates share one deployment. Which transport does each use, and where does auth differ?

Local instances run over stdio as child processes, inheriting the developer's environment and credentials. The central deployment speaks streamable HTTP and authenticates like any web service, with OAuth-style flows and per-caller identity. The graded second beat: the shared server's configuration belongs at a shared scope with secrets referenced from the environment, while a stem that shows an API key committed in project config is handing you the security flaw to name.

Next steps

Build one loop, harden one directory, then drill: the practice tests ask this quarter of the exam as debugging scenarios, and the mistakes article covers the traps from the losing side. The free sampler is the no-cost calibration.

Sources:

• Claude tool use documentation
• Claude Agent SDK documentation
• Model Context Protocol
• Claude Code hooks documentation