Tool use (function calling)
In shortTool use, also called function calling, lets a model request an outside action, such as a search or a calculation, which an app runs and feeds back.
In plain words
A model alone only writes text. With tool use, you give it a list of tools: a name, a short description and the inputs each one takes. When the model decides it needs one, it does not run anything itself. It writes a structured request, such as "call weather with city = Bern". Your app runs the tool and sends the result back, and the model uses it to write the final answer. OpenAI and Google call this function calling. Anthropic calls it tool use. The pattern is the same.
Some providers also offer tools that run on their side, for example web search. For tools that you define, your own code does the work and keeps control over what happens. A 2023 research paper, Toolformer, showed that models can learn when to call tools such as a calculator or a search engine.
Why it matters
- Live and private data: A model has a knowledge cutoff. A tool gives it today's weather, your calendar or your database.
- Reliable steps: Maths, dates and database queries are better done by code than by a guess in text.
- Cost: The tool descriptions are sent with each request, so they use tokens and part of the context window. Each tool round is another model call.
- Safety: The model asks, your app decides. Let the app check inputs, limit what a tool may do, and ask a person before actions that cannot be undone, such as sending money or deleting files.
- Untrusted results: Text that comes back from a tool, such as a web page, may hold hidden instructions (prompt injection). Treat it as data, not as orders.
- Building block: Tool use is the base of every AI agent, and MCP standardises how tools are offered.
Example
You build a travel assistant with one tool, get_train_times(from, to, date). A user asks: "When is the next train from Bern to Zurich?" The model replies with a tool request. Your app calls a timetable service, gets three departures, and returns them. The model then answers in plain words. The model never touched the timetable service; your app did.
Common misconceptions
- "The model runs code by itself." For your own tools, the model only asks. Your app runs them.
- "Tool use means web access." Only if you provide a web tool.
- "More tools are always better." Many tools raise cost and confusion. Offer what the task needs.
Questions and answers
What is the difference between tool use and function calling?
They name the same pattern. The model returns a structured request to call a function, your app runs it and returns the result.
Does the model execute the tool itself?
For tools you define, no. The model only writes the request. Your app runs it. Some providers also run built-in tools, such as web search, on their side.
Is tool use safe?
It is as safe as the limits you set. Validate inputs, give tools the least access they need, and require human approval for risky actions.
Read next
- AI agent
An AI agent is a system where a model plans, uses tools and checks results in a loop to reach a goal with little step-by-step guidance.
- MCP (Model Context Protocol)
MCP (Model Context Protocol) is an open standard for connecting AI applications to external data, tools and workflows through one shared interface.
- Prompt injection
Prompt injection is an attack where text a model reads, such as a web page or file, contains instructions that make it act against its user.
- Context window
The context window is the maximum amount of text, counted in tokens, that a model can read and write in one request.
- Coding agent
A coding agent is an AI tool that reads a codebase, edits files and runs commands and tests in a loop to finish a programming task.