Qwen3 launched in 2025 with hybrid thinking modes, and the official Qwen material recommends Qwen-Agent for tool and MCP workflows. It is a useful teaching combination, but Qwen3 is not a new 2026 model.

The example uses mock tools rather than a live service. The model proposes a call, while the application validates, authorizes, and executes it. MCP standardizes messages; it does not own business permission.

Freeze the model and operating mode

Record the specific Qwen3 model card, inference runtime, chat template, Qwen-Agent commit, MCP revision, and sampling settings. Use non-thinking mode as a candidate for simple reads. Enable thinking for multi-step planning only with token and step limits. /think and /no_think are control signals and must not be freely injected by untrusted tool content.

Run both modes on the same tasks and compare completion, correct calls, latency, and output tokens. Longer thinking is not proof of quality. Deterministic schema and domain validation should remain code instead of being delegated to repeated model reflection.

Quantization and local serving settings belong in the version record too. A model name without its template and runtime is not a reproducible agent configuration.

Define authority with mock tools

from dataclasses import dataclass

@dataclass(frozen=True)
class ToolResult:
    ok: bool
    data: dict

def lookup_inventory(sku: str, tenant: str) -> ToolResult:
    if not sku.startswith("SKU-"):
        return ToolResult(False, {"error": "invalid_sku"})
    fixtures = {("acme", "SKU-42"): 7}
    if (tenant, sku) not in fixtures:
        return ToolResult(False, {"error": "not_found"})
    return ToolResult(True, {"sku": sku, "available": fixtures[(tenant, sku)]})

The registry exposes only a fixed name, strict schema, and handler. Reject unknown tools. Production credentials stay in the executor, and tenant comes from authenticated context rather than model arguments. Even when an MCP annotation claims that a tool is read-only, the client evaluates its own registry and server trust.

Use mock handlers with the same validation contract as production. A permissive mock teaches the orchestration layer the wrong behavior and leaves security failures undiscovered until integration.

Treat tool results as data

A web or repository tool can return text saying “ignore prior rules.” Delimit content as untrusted data and prevent it from changing system instructions, thinking mode, tool inventory, or approval policy. An output schema reduces parsing ambiguity; it does not establish factual correctness. Run domain validation after execution.

Allowlist MCP servers and pin their configuration. Constrain an stdio child’s working directory and environment. For HTTP, validate token audience and never pass a client token unchanged to a downstream system. Keep write tools disabled by default. When enabled, they need a business idempotency key and action-time approval.

Minimize tool results. Return a bounded object with evidence identifiers instead of full documents or internal exceptions.

Make recovery a first-class path

The product task moves through planning, calling, waiting_approval, recovering, and terminal states. Persist call id, normalized argument hash, result, and retry count. A transient read can retry with backoff. Invalid arguments, permission denial, and not-found results do not. An unknown external state triggers reconciliation.

Set a six-step maximum, one retry per eligible read, and a wall-clock budget. Stop when the same call fails repeatedly and report what information is needed. On restart, load completed steps from the product database instead of treating an old transcript as the only truth.

For writes, reserve the idempotency key before execution. If the worker crashes after an external success, reconciliation finds the committed operation and attaches its result rather than performing it again.

Test an agent, not a demo

Fixtures should include normal inventory, malformed SKU, cross-tenant id, timeout, prompt injection, duplicate call, restart, and cancellation. Assert tool choice, argument provenance, no unauthorized access, error classification, stopping behavior, and agreement between the final answer and tool facts. Replay mock traces after upgrading Qwen, the runtime, or Qwen-Agent without creating real side effects.

Report task success separately from safety violations; one cross-tenant read cannot be averaged away. When comparing thinking and non-thinking, freeze tools, template, data, sampling, and budgets. Inspect trajectories as well as final prose.

Before granting production authority, run a shadow phase that records proposed calls without executing real writes. Compare proposals with the existing workflow, classify failures, and verify stopping behavior under realistic latency. Enable low-risk read tools one class at a time. Writes remain separately approved even after read-only shadow results look strong.

Qwen3 and MCP reduce the wiring needed for a tool-using agent. Reliability still comes from application controls: frozen versions, bounded thinking, a default-deny registry, idempotent records, and recoverable state. Make every mock failure explainable before connecting a real system. That path is less exciting than a one-shot demo and far more useful in production.