Build-Time vs. Run-Time: Why Dev Tools Fail in Production — Averi Kitsch & Prerna Kakkar, Google

In one of the demos an agent hits an error, decides the fix is to delete the table and start fresh, and does exactly that. Nothing stops it. Averi Kitsch, technical lead for MCP Toolbox on Google Cloud databases, and Prerna Kakkar, who leads Eval Bench at Google, use that failure to draw the line their talk is named for. Build time tools serve developer assistance: control plane tools that manage instances, and natural language to SQL that writes whatever query a question needs. They are flexible, belong under a human, and do not belong in production. Run time tools are the opposite, structured SQL with parameters fixed ahead of time, closing off injection, cutting latency, and leaving no room to invent. The second half is security. A database is only as secure as the agent in front of it, and the confused deputy attack is the shape to watch. A triage agent reads a ticket, a planted instruction tells it to query the salary table and post the results back, and it complies because it has the privileges. Their answer separates user, application, and agent identity, then walks a tool from super user down to something narrow. Connection details move into a YAML source the agent never sees, read only enforcement reaches down to the driver, allowed data sets and output caps bound the blast radius, and custom tools pin the exact SQL behind prepared statements. Sensitive values like a user id are bound by the application, so the agent never handles them. They close on tool quality: outcome shaped tools, read split from write, and errors an agent can act on. Speaker info: - https://www.linkedin.com/in/averikitsch - https://averi.dev - https://www.linkedin.com/in/prernakakkar95/ Timestamps: 0:00 - Introductions, MCP Toolbox and managed MCP 2:56 - Common tool patterns for databases 4:37 - Structured SQL tools for production 5:20 - Build time against run time 6:16 - When a build time tool deletes the table 8:46 - Your database is only as secure as your agent 9:13 - The lethal trifecta and the confused deputy 11:19 - Separating user, application, and agent identity 12:33 - Evolving a tool from super user to constrained 14:55 - Custom tools and prepared statements 15:52 - Best practices for tool quality 17:39 - Bound parameters, keeping PII from the agent