The Agentic Glossary: One Vocabulary Across Every Coding Agent

33 terms

• Agent loopLoop & contextThe core cycle a coding agent runs — gather context → take action → verify work → repeat — getting "ground truth" from the environment at each step. It is what separates an agent (the model directs its own process) from a workflow (control lives in predefined code).
• Workflow vs. agentLoop & contextTwo architecturally distinct kinds of agentic system: a workflow orchestrates LLMs and tools "through predefined code paths" (you own the plumbing), whereas an agent is a system where the LLM "dynamically direct[s] its own processes and tool usage" (the model owns the plumbing).
• Augmented LLMLoop & contextThe basic building block of every agentic system: "an LLM enhanced with augmentations such as retrieval, tools, and memory" — a model that can generate its own search queries, pick tools, and decide what to keep.
• Context windowLoop & contextThe finite token budget that holds the agent’s entire working state for a session — every message, file read, command output and tool result, not just your prompts. Performance degrades as it fills, which is why managing it is the single most important skill.
• Context engineeringLoop & contextThe craft of deciding what occupies the context window and what does not — keeping the "workbench" clear of file dumps and finished tool output so the model stays sharp. Tool results and file reads, not your prose, are the biggest consumers.
• CompactionLoop & contextWhen the conversation nears the context limit the agent summarizes the history — preserving code patterns, file states and key decisions — and frees the rest of the space so work continues. The summary is lossy by design.
• MCPMCPAn open standard for connecting AI applications to external systems — "a USB-C port for AI applications" — so a server written once works in any MCP client. Current spec revision 2025-11-25; two transports: stdio (local subprocess) and Streamable HTTP (remote; the old HTTP+SSE transport is deprecated).
• MCP toolMCPAn action an MCP server exposes that the model can call — query a database, open a pull request, run a script. Tools are the capability you lean on hardest; each is namespaced by server.
• MCP resourceMCPData an MCP server exposes for the model to read, referenced with an @-mention like a file. The client fetches it via resources/read and injects the content.
• MCP promptMCPA pre-built workflow an MCP server publishes as a slash command, discovered dynamically from connected servers and injected into the conversation.
• Tool searchMCPA scaling fix where the agent loads only MCP tool names at startup and pulls a tool’s full schema on demand, so connecting many servers costs almost no context. On by default in Claude Code; tunable with ENABLE_TOOL_SEARCH.
• SubagentDelegationA separate agent instance with its own fresh context window that does verbose, self-contained work (deep reads, log-spelunking) out of sight and returns only a summary, keeping the main conversation clean. It does not see your conversation history.
• ForkDelegationA deliberate exception to subagent isolation: a subagent that inherits the entire conversation so far (same system prompt, tools, model, history) so you can hand off a side task without re-explaining — yet its own tool calls stay out of your main window. Its first request reuses the parent’s prompt cache, making it cheaper than a fresh subagent.
• Fan-outDelegationRunning multiple agents in parallel — pre-defined independent subtasks (sectioning) or a central orchestrator that dynamically decomposes work and synthesizes. Anthropic’s multi-agent system beat single-agent Opus by 90.2% on their internal eval, but used ~15× more tokens than chat.
• HookControl & safetyA shell command (or webhook / MCP-tool / model call) the agent runs automatically at a named lifecycle event — making a behavior deterministic instead of relying on the model’s judgment. Canonical use: format every edited file, block dangerous commands, gate "done" on passing tests.
• SkillDelegationA reusable, on-demand capability packaged as a folder with a SKILL.md (YAML frontmatter saying when to use it + a body saying what to do), loaded only when relevant via progressive disclosure (~100 tokens of metadata until triggered). It follows the open Agent Skills standard.
• Progressive disclosureDelegationThe three-level loading scheme that makes skills cheap: Level 1 = name + description always resident (~100 tokens), Level 2 = the SKILL.md body loaded only when triggered (<~5k tokens), Level 3 = bundled files read only when a task needs them (effectively unlimited).
• Slash commandControl & safetyA named behavior invoked by typing /name at the start of a message — built-in (/clear, /model, /permissions) or custom (a markdown file whose filename becomes the command). Arguments after the name substitute into $ARGUMENTS.
• Plan modeControl & safetyA read-only / plan-first mode where the agent researches the codebase, asks clarifying questions and produces a reviewable plan before changing any files. The single biggest quality lever on large multi-file work.
• Permission / approval modeControl & safetyThe overall stance toward prompting before the agent acts — from "ask on every tool" to "auto-approve everything." This is the consent dial (distinct from the sandbox, which is the containment dial).
• Allow / ask / deny rulesControl & safetyThe rule lists the harness checks before a tool runs, evaluated in fixed order deny → ask → allow (first match wins; specificity does not change order), so a deny is the only hard guarantee. Enforced by the harness, not the model — a rules file is advice; a deny rule is a wall.
• YOLO modeControl & safetyThe auto-approve-everything tier that skips all prompts — fast and dangerous, intended only for isolated containers/VMs. Several tools deliberately couple it with the sandbox or refuse to persist it.
• SandboxControl & safetyOS-level isolation that limits what a command can actually reach — filesystem and network — regardless of what the model decided to run; this is the containment dial. Effective sandboxing needs both filesystem and network isolation.
• CheckpointTime travelAn automatic snapshot of code state taken before each agent edit, so you can roll back the files, the conversation, or both — without touching git. The unit of rewind is the prompt you sent. Caveat: it tracks edit-tool changes only — bash rm/mv/cp are not undoable.
• RewindTime travelThe interactive undo that opens the checkpoint list and lets you restore code and/or conversation, or summarize from / up to a point. Reachable by command or by pressing Esc twice on an empty input.
• Folder / workspace trustControl & safetyA gate that refuses to load a project’s config, tools and MCP servers until you mark the folder as trusted — because a checked-in .mcp.json, skill, or command can grant itself broad access. The first defense against a malicious repo.
• Prompt injectionQualityAn attack where trusted instructions and untrusted data arrive in the same token stream and the model can’t reliably tell them apart — named after SQL injection by Simon Willison in 2022. LLMs "are unable to reliably distinguish the importance of instructions based on where they came from."
• Lethal trifectaQualityThe three capabilities that, combined in one session, make data exfiltration via prompt injection nearly guaranteed: (1) access to private data, (2) exposure to untrusted content, (3) the ability to externally communicate. The mitigation is architectural — don’t combine all three legs.
• EvalQualityA test for a non-deterministic system: give the agent an input, run it, then apply grading logic to what it produced — over enough tasks and trials that a trustworthy number falls out. It is the regression suite for everything that isn’t code: the prompt, the rules file, the tool definitions, the model.
• LLM-as-judgeQualityA grader that uses a model to score output against a rubric (pointwise), pick the better of two (pairwise), or critique against a gold reference — flexible for open-ended quality, but non-deterministic and only trustworthy once calibrated against human labels.
• pass@k vs pass^kQualityThe two honest metrics for non-deterministic agents: pass@k = probability at least one of k trials succeeds (measures capability); pass^k = probability all k trials succeed (measures reliability — the harder, production-relevant number). A single greedy run is not an eval.
• AGENTS.mdLoop & contextThe cross-tool open standard for the agent’s project briefing — a plain-Markdown "README for agents" with no schema, stewarded by the Agentic AI Foundation under the Linux Foundation and read by ~24 tools; used by 60k+ projects. Nested files supported; "closest file wins."
• Headless / CI modeControl & safetyRunning the agent without a human at the prompt — for scripts, pre-commit hooks, CI jobs and cloud tasks — authenticated by API key rather than browser login, and gated by least-privilege tokens and a sandbox because PR titles/diffs are untrusted content (a lethal-trifecta leg).