One agent, every tool.
I run my task systems, calendar, files, and repos through one agent over MCP, and I built the rules that keep it safe at scale.
Driving a dozen tools from one agent is the easy part. The real work is making a bulk operation across all of them idempotent, reversible, and verified, so I can re-run it, undo it, and trust that it did what it said.
A dozen tools, one operator, one source of truth.
Todoist, Linear, GitHub, Gmail, Calendar, and Google Drive, all driven from one agent over MCP. The architecture is deliberate: Todoist is canonical, everything else mirrors it with two-way links, so there’s never a question of which system is right.
Bulk work, done reversibly.
Tri-tracker sync
Linear ↔ GitHub ↔ Todoist across ~52 projects, 383 GitHub issues mirrored. An idempotent backfill: the link attachment is the dedup key, so re-running only touches what’s unlinked.
Task consolidation
1,056 tasks merged from scattered spreadsheets and Apple Reminders into one system, every created task tagged so the whole import rolls back by label.
Drive dedup & recovery
~3 TB of MD5-verified duplicates cleared server-side. Then a full disaster recovery after a sync accident: 194/194 folders, 238/238 files, zero losses.
Every one of these is designed to be re-run without damage and undone by a single label or log, because a bulk action you can’t reverse is a bulk action you shouldn’t run.
The agent’s “done” is not done.
During the sync, a subagent reported 9 links missing. I checked by hand: all 121 were missing. Another time, parallel agents sharing one temp directory raced each other and created 47 duplicate mirror issues.
Never trust a self-report. Verify each item directly, and give every parallel agent its own temp space so they can’t collide.
Batch against the API’s real limits, keep an audit trail, make it resumable. Scale is a discipline, not a speed.
What does operations judgment look like here?
Anyone can ask an agent to move some tasks around. Designing bulk operations that are idempotent, reversible, verified, and rate-limit-aware across half a dozen live systems is a different skill, and it’s the one that makes agent orchestration trustworthy instead of scary.
I don’t hand my systems to an agent and hope. I govern the partnership.
Set the architecture, license the agent to move fast, and build the guardrails (reversible, verified, idempotent) that make trusting it a decision rather than a gamble.