Using Mandaitor with Anthropic Claude & MCP

Module 04 · Agentic systemsInteroperability

Using Mandaitor with Anthropic Claude & MCP

Intermediate12–16 min2 prerequisites

Before you start

• Understand Mandaitor's mandate, tool and execution model.
• Basic familiarity with Claude tool use or the Model Context Protocol.

After this lesson you can

• explain how Claude tool use and MCP clients reach Mandaitor
• connect an MCP client to Mandaitor as an agent and have a tool call carried out
• see why a neutral server that acts makes the authority boundary hold for every client

Anthropic's Claude uses tool use to call functions you define, and the Model Context Protocol (MCP) standardizes how agents connect to tools. MCP is an open protocol: Anthropic originated it, and it is adopted well beyond any single provider. Mandaitor is an MCP server. An agent's MCP client connects to it as to any remote MCP server, and every tool call it makes is decided against the agent's mandates and carried out by Mandaitor, whichever model or client made it.

For Anthropic's own framing of what an agent is, hear it from the source: this talk distinguishes workflows (LLMs orchestrated through predefined code paths) from agents (models that dynamically direct their own process and tool use), and argues for starting simple. The tool call is where an agent's decision becomes an action, and that is the point Mandaitor takes over.

Anthropic's Barry Zhang on the workflow-vs-agent distinction and practical agent design: the tool-call loop in which Mandaitor carries out business operations.

Claude tool use and MCP, briefly

• Claude tool use: you pass Claude a set of tools. When it decides to use one, your application receives a tool-use request, runs it, and returns the result to Claude.
• MCP: instead of hard-wiring tools into one application, an MCP server exposes tools over a standard protocol, and any MCP client can list and call them.

Mandaitor's MCP server lists the tools the agent's mandates could back, and runs each call as an execution: it reads the record from the target system, decides on what it read, asks a person where a mandate says so, writes with its own credential, and answers with the outcome and a signed receipt.

Protocol-neutral

One server, any client

Mandaitor speaks MCP, so any MCP client can connect as a registered agent. Every client is held to the same mandates, because the decision and the write happen in Mandaitor, not in the client.

Listed by mandate

Only what could be backed

tools/list shows the tools the agent's mandates could back now. A call to one it leaves out is decided like any request, and denied.

Evidence by default

Every write is provable

A written operation comes back with a signed receipt, which names the Proof-of-Mandate the write was made on.

The pattern in code

Connect an MCP client as the agent, with the official MCP SDK and the key the agent registered. Then offer Mandaitor's tools to Claude, and pass each tool-use request on:

import Anthropic from "@anthropic-ai/sdk";
import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
import { PrivateKeyJwtProvider } from "@modelcontextprotocol/sdk/client/auth-extensions.js";

// The agent connects as itself: its DID and its registered key. No SAP credential anywhere.
const authProvider = new PrivateKeyJwtProvider({
  clientId: process.env.AGENT_DID!,
  privateKey: process.env.AGENT_PRIVATE_KEY_PEM!,
  algorithm: "ES256",
  expectedIssuer: "https://api.mandaitor.io/v1",
});
const mcp = new Client({ name: "procurement-agent", version: "1.0.0" });
await mcp.connect(
  new StreamableHTTPClientTransport(new URL("https://api.mandaitor.io/v1/mcp"), { authProvider }),
);

// Claude sees the tools the agent's mandates could back.
const { tools } = await mcp.listTools();
const anthropic = new Anthropic();
const response = await anthropic.messages.create({
  model: process.env.ANTHROPIC_MODEL!,
  max_tokens: 1024,
  tools: tools.map((tool) => ({
    name: tool.name,
    description: tool.description,
    input_schema: tool.inputSchema as Anthropic.Tool.InputSchema,
  })),
  messages: [{ role: "user", content: "Release requisition 10000124: the Q4 capex review approved it." }],
});

// Each tool-use request becomes an execution. Mandaitor decides, and writes if allowed.
for (const block of response.content) {
  if (block.type === "tool_use") {
    const result = await mcp.callTool({
      name: block.name,
      arguments: block.input as Record<string, unknown>,
    });
    // Return result.content to Claude as the tool_result for block.id.
  }
}

The tool result says what happened in words Claude can use: written, waiting for a person's approval until a deadline, or refused with the reason. Its structured content is the execution itself, receipt included. Only registered agents connect: a desktop assistant used by a person cannot sign in to Mandaitor's MCP server yet.

ScenarioPlatform team

Two clients, one boundary

One team's Claude-based assistant and another team's internal agent both connect to Mandaitor's MCP server, each as its own registered agent. Each sees only the tools its mandates could back. When the internal agent asks for a release above its threshold, the procurement lead approves it first. When the assistant asks for a requisition of a plant outside its mandate, the request is denied. Neither holds a SAP credential, so neither can work around the decision.

Claude / MCP concept	Mandaitor concept
Tool use request, tools/call	An execution: one tool, one record
MCP server tool	A tool the tenant enabled, which a mandate naming the agent could back
Session / caller identity	The registered agent, authenticated with a key only it holds
Tool input arguments	The record's identifier and an optional purpose, never its facts
Tool result / error	The execution: written with a receipt, waiting for an approval, or refused with a reason

Check your understanding

Why does it matter that Mandaitor is the MCP server, rather than a check the client calls?

• Because the decision and the write happen in Mandaitor: a client can only ask, so every request is decided against the agent's mandates on the record's own facts.
• Because MCP clients authorize themselves.
• Because only Anthropic clients can call MCP tools, so the risk is limited.

Reveal answer

A check the client calls can be skipped, or asked about one record while another is written. When the server itself decides and acts, there is no path to the target system that does not go through the mandate, whichever client or model made the call.

From concept to implementation

Mandaitor has hands-on guides for connecting MCP clients. Use them when you move from this mental model to real code.

• MCP Server: connect an MCP client, what tools/list shows, and how each call answers.
• MCP Authorization Server: how an agent authenticates with its own key, and the session it gets.
• Executions: what happens to each call, from the decision to the receipt.
• Agentic Authorization and Runtime Evidence: the concept behind deciding at the moment of action, and the evidence it leaves.

Progress

Save your learning progress

Mark this lesson as complete to update the Academy overview without requiring an account.