There is no universal number, but every agent needs hard caps on tool calls per task, turns per loop and calls per minute. The MCP spec says servers must rate limit tool calls and that both sides should set iteration limits for tool loops. Set limits from observed normal use, with headroom, and alert when they trip.
Why limits are a security control
A loop with no cap is a path to runaway cost, a flood of requests against a downstream system and a way for an injected instruction to repeat an action many times. OWASP lists rate limiting among measures that limit the damage of excessive agency, though it does not remove the cause.
The MCP tools page says servers must rate limit tool invocations. The sampling page says both parties should implement iteration limits for tool loops, and the example flow notes a server might cap iterations and force a final answer on the last one.
Three kinds of limit
| Limit | Protects against | How to set it |
|---|---|---|
| Calls per task | Runaway loops | Cap at a multiple of the 95th percentile |
| Calls per minute | Floods and abuse | Per identity, per tool |
| Spend or tokens per task | Cost spikes | Budget with alert and hard stop |
Add a separate lower limit for high impact tools such as deletes, payments or deployments.
How to pick numbers
- Run the agent on real tasks for a week with no cap but full logging.
- Record the number of tool calls per completed task.
- Set the soft limit above the normal maximum and the hard limit above that.
- Set stricter caps on write and destructive tools.
- Review after each model or prompt change, because behaviour shifts.
What happens at the limit
Decide in advance. Options are to stop and ask the user, to stop and report partial work, or to downgrade to read only tools. Do not let the model quietly retry through a different tool, which defeats the cap. Return a clear execution error so the agent can explain.
Enforce outside the model
A prompt that says do not call more than ten tools is a suggestion. Enforce counts in the client, a proxy or the server, and key them to the agent identity so one noisy agent cannot use another's budget.
Safeguard includes policies, gates and guardrails and agent identity, which let you apply per agent rules. A free scan is at https://gold.safeguard.sh/scan.
Quick check
Should limits differ per tool?
Yes. Reads can have a generous cap. Writes, deletes and anything that spends money should have much lower limits and often an approval step.
Is a token budget the same as a call limit?
No. A token budget limits model cost, while call limits protect downstream systems. Use both.
Sources
- MCP specification: Tools (draft)
- MCP specification: Sampling (draft)
- OWASP GenAI: LLM06 Excessive Agency
Last reviewed: 19 October 2026.
