Your AI Agents Are Drowning in Tools — Here's the Fix

Here's a pattern we see constantly: a business gets its first AI agent working, it's genuinely useful, so they connect it to more things — the CRM, the project board, email, billing, the deploy pipeline. And somewhere around the tenth integration, the agent quietly gets worse. What I mean by 'we see this constantly' also includes our own experience with this mess.

Slower can be OK, but if it is caused by underlying inefficiency, it likely equates to 'more expensive to run'. More likely to grab the wrong tool. And if you look under the hood, copies of your API keys are now scattered across a dozen different configs.

This isn't a flaw in any one tool. It's a structural problem with how AI agents load their capabilities — and it's exactly the kind of unglamorous infrastructure problem we like to solve. So we built something for it, and we open-sourced it. It's called Janus.

The problem nobody warns you about

Modern AI agents get their abilities by connecting to tool servers (the emerging standard is called MCP — the Model Context Protocol). Each server advertises its tools, and the agent has to load the full description of every tool, on every server, into every session — before it does any real work.

With one or two servers that's fine. But each new integration adds more tool descriptions the model has to read and reason about every single time. Three things happen as the list grows:

• Cost goes up. Those tool descriptions are part of the prompt. You pay for them on every call, whether the agent uses them or not.

• Accuracy goes down. Ask a person to pick the right tool from a list of ten and they're fine; from a list of a hundred, they start making mistakes. Models are no different.

• Security gets messy. Every agent that connects to a server needs that server's credentials — so your keys end up copied into many places, with no single record of what was used or when.

Loading every server into every session simply doesn't scale.

What we did: one door, not a hundred

Instead of having the agent connect to twenty servers, it connects to one — Janus — which exposes a small, fixed set of about seven “broker” tools. The dozens of real tools live behind

When the agent needs to do something, it works in three steps: search for a relevant capability, describe the one it wants to understand its inputs, then call it. Capabilities are discovered just in time instead of dumped up front, so the model sees roughly seven tools instead of a hundred-plus — every session, every call.

Less to read means lower cost and sharper tool selection. That part is immediate and measurable.

Secure by default — not as an afterthought

The more interesting half is what a single door lets you enforce. Because every request now flows through one place, Janus can broker it:

• Deny by default. A capability is unusable until it's explicitly approved, and risky actions — anything that writes, deploys, spends money, or deletes — are gated behind policy and confirmation, scoped to each agent's role. You can let an agent read everything while still locking down the handful of actions that could actually hurt.

• Credentials the agent never sees. Secrets live with the gateway. They're injected into the downstream call at the last moment and stripped out of anything that comes back. The model never sees a key, and neither do the logs. Rotating a key becomes a one-place change instead of a scavenger hunt.

• Every action audited. There's an append-only record of which capability was called, by which agent, when, and whether policy allowed it. That's the difference between “we're pretty sure the agent only did safe things” and “here's the log.”

• Tamper resistance. If one of those downstream tools quietly changes its own description — a known attack vector for AI agents — Janus notices, quarantines it, and waits for a human to re-approve it rather than trusting the change blindly.

What this means for your business

If you're putting AI agents to work, the failure modes above are coming for you whether or not you have a name for them yet. A gateway like Janus turns them into solved problems:

• Predictable, lower running costs as you add integrations — not a bill that creeps up with every one.

• Better answers, because the model isn't wading through a hundred tools to find the right one.

• A governance and compliance story you can actually show someone: one place for credentials, one policy, one audit trail.

• Confidence to give agents more power, because the dangerous actions are gated instead of wide open.

The bigger point

We didn't build Janus as a product to sell you. We built it because we run AI infrastructure in production — for our own products and for clients — and we needed it. That's the whole Novique philosophy in one example: deployment over features, secure by default. The hard part of AI isn't a clever demo; it's the boring, reliable plumbing that makes the demo safe to run every day.

Janus is open source — you can read the code, the architecture, and the security model on GitHub.

And if your own agent stack is starting to sprawl — too many integrations, keys in too many places, no record of what the agent actually did — that's exactly the kind of infrastructure we build and operate for our customers. Book a consultation and we'll help you put one clean, secure door in front of it.