What is tool calling (function calling) in LLMs?

A model with tools is no longer limited to what it memorised; it can look things up and take actions. Tool calling is the mechanism that makes that possible, and nearly every AI agent is built on it.

How does tool calling work?

Tool calling is a loop between the model and your code. The model decides a tool would help, returns a structured request instead of a normal answer, your application runs the tool, and the result goes back to the model.

1. 1
   Describe the tools

   Your request includes each tool's name, a description of what it does, and a JSON Schema for its inputs.
2. 2
   Model decides

   Given the user's message, the model either answers directly or returns a tool call: the tool name and arguments, such as get_weather with city set to "Pune".
3. 3
   Your code runs it

   The application validates the arguments, calls the real function or API, and captures the result or error.
4. 4
   Return the result

   You send the result back to the model as a tool result message, linked to the original call.
5. 5
   Model continues

   The model uses the result to answer, or calls another tool. This repeats until it produces a final answer.

The key point is that the model only produces text describing a call. Running it, checking permissions and handling errors are your application's job. That is also where you enforce safety.

What does a tool definition look like?

A tool definition is a name, a description and an input schema. Here is a typical one, in the general shape most providers use:

{
  "name": "search_orders",
  "description": "Search a customer's orders by status. Use when the user asks about the status, delivery or contents of their orders. Returns at most 10 orders, newest first.",
  "input_schema": {
    "type": "object",
    "properties": {
      "customer_id": { "type": "string" },
      "status": { "type": "string", "enum": ["pending", "shipped", "delivered", "cancelled"] }
    },
    "required": ["customer_id"]
  }
}

The description does most of the work. The model decides whether and how to call a tool mainly from its name and description, so describe when to use it, what it returns and its limits, as you would for a new colleague.

Where did tool calling come from?

Research in 2022 and 2023 showed that language models could learn to use external tools. The ReAct paper combined reasoning steps with actions such as searches, and Meta's Toolformer taught a model to insert API calls into its own text. OpenAI added function calling to its API in June 2023, and other providers followed, with Anthropic's tool use becoming generally available in 2024. Today models are trained specifically to decide when to call tools, choose arguments and use results.

How do you design good tools?

Good tools are few, clearly named and return concise, useful results. The free MCP guide's chapter on tool design goes deeper, but the main rules are:

• ✓Do: Give each tool one clear job, and name it after that job
• ✓Do: Write descriptions that say when to use the tool and when not to
• ✓Do: Use enums and required fields so invalid arguments are hard to produce
• ✓Do: Return compact, relevant results with clear error messages the model can act on
• ✓Do: Require human confirmation for actions that spend money, send messages or delete data
• ✕Avoid: Expose dozens of overlapping tools; the model will pick the wrong one more often
• ✕Avoid: Return huge raw payloads that flood the context window
• ✕Avoid: Trust arguments without validating them in code

How does tool calling relate to MCP?

Tool calling is the model-level ability; the Model Context Protocol is a standard way to package and share tools. Without MCP, each application defines its tools in its own code for one provider's API. With MCP, a tool is implemented once in an MCP server, and any MCP-compatible application can discover it and offer it to its model, which then calls it through the same tool-calling mechanism.

What are the risks of tool calling?

The main risk is that a model can be manipulated into calling tools you did not intend. If a model reads an email or web page containing hidden instructions, prompt injection can lead it to call a tool with harmful arguments. Limit each tool's permissions to the minimum, keep sensitive actions behind confirmation, and log every call.