Developer proposes agent-sharing model inspired by SQLite

A developer working with AI agents has articulated a long-standing deployment challenge: the ability to share a genuinely capable agent — one with its own decision loop, integrated tools, and learned judgment — with a colleague or external party without either exposing API keys to token theft or locking the agent permanently to the original builder's machine and credentials. Two common industry approaches have been proposed, but both fall short. The Model Context Protocol (MCP) provides a tool endpoint — a request/response interface — but leaves the agent's decision loop running on the original server, preserving the autonomy problem rather than solving it. Skills, which are meant to travel as portable files, introduce two distinct risks: they are untrusted markdown injected into an agent's context, and the moment they instruct an agent to do anything beyond prompting, they trigger arbitrary code execution — a vector for both prompt injection and uncontrolled execution. Moreover, skills are instructions, not agents, because their execution harness is unknown or uncontrolled. A partial workaround, sampling (which allows an agent to use the caller's own AI model to perform a task), was formally deprecated this month via SEP-2577, effectively closing that experimental path. Inspired by the SQLite model — known for being embeddable, file-based, and self-contained — the developer indicates a different approach may be possible, though the full proposal is not completed in this post. The core insight is that agents, like databases, may need to be distributable units that carry their execution context and autonomy with them, rather than remaining server-bound or credential-locked.

The post surfaces a genuine friction point in the emerging AI agent ecosystem. As agents grow more capable and autonomous, the incentive to share them — across teams, vendors, or end-users — grows too. Yet the technical and security model for doing so remains unsolved. The developer correctly identifies why the two most common approaches fall short. MCP, designed for tool composition, was never intended to move autonomous agents; it stops at providing request/response endpoints, leaving orchestration and loop control server-side. Skills, conceived as portable instructions, lack the runtime harness and trust model needed for true agent transfer — they collapse into prompt injection the moment they ask an agent to execute code. The deprecation of sampling this month via SEP-2577 removes even a partial experimental workaround. The SQLite comparison hints at the developer's goal: a file-based, embeddable model that travels with its own execution context and does not leak security or autonomy back to a single API key holder. Whether that analogy holds remains to be seen in the full proposal.

No comments yet. Be the first to share your thoughts!