AI 101 — What is tool calling?

Tool calling — also called function calling — is a language model's ability to say "I need this specific external action run, with these exact arguments" instead of answering from memory. The model does not run anything. It writes a structured request in a format your code agreed to in advance, and your code does the doing. That one handshake is what turns a chatbot into software that can book, query, calculate, and file.

Why it matters right now

Every agent story you read this month rests on it. A coding agent that opens a pull request, a car agent that pays a toll, an assistant that checks a calendar before replying — none of those models have hands. They have a way to request work, and a loop that feeds the result back.

OpenAI shipped the mechanism as a public API feature on June 13, 2023, in the gpt-4-0613 and gpt-3.5-turbo-0613 models, with the pitch that it was "a new way to more reliably connect GPT's capabilities with external tools and APIs." Anthropic, Google, and every open-weights framework that matters copied the shape. By 2026 it is table stakes: a model that cannot emit a valid tool call cannot be used as an agent, and shipping a model without that ability is a product decision, not an accident.

The mental model

Five moves, repeated in a loop.

One — publish a menu. You hand the model a list of tools: a name, a plain-English description of what it does, and a schema (usually JSON Schema) declaring each argument's name, type, and meaning.

Two — the model decides whether to order. Given your question, it either answers from what it already knows or picks a tool. Anthropic calls this the auto tool choice; you can also force a specific tool or forbid one.

Three — it emits a call, not prose. Out goes a structured object: which tool, which arguments. get_current_weather(location: "Boston", unit: "celsius"). Machine-readable, so your code can act on it without parsing an essay.

Four — your code executes it. This is the part people get backwards. The model never touches the weather service, the database, or the bank. Your application runs the call and returns the result as a new message.

Five — the model reads the result and answers, or orders again. Reasoning and acting interleaved like that is the pattern the ReAct paper described in October 2022, and it is still the shape of an agent loop. What is an AI agent? covers that wrapper in full.

An everyday analogy

A restaurant kitchen. You tell the server you want the lamb, medium rare, no onions. The server cannot cook — does not need to know how. What the server can do is translate your messy sentence onto an order ticket with exactly the fields the kitchen reads: dish, temperature, exclusions. The kitchen runs the ticket, sends back a plate, and only then does the server bring it to you and answer your question about the side.

A bad order ticket wastes a whole pass. So does a badly specified tool. That is why the description and the argument schema matter more than most prompts do: the model can only order from a menu it can read.

Common misconceptions

"The model executes the tool." No. It requests. Your code executes, and your code is where permissions, rate limits, and confirmations live. Any product that lets a model act without that layer is not more autonomous — it is less monitored.

"Tool calling is the same as MCP." Tool calling is a model capability: emit a well-formed call. The Model Context Protocol is a standard for delivering tools and results between an application and a server, so you do not hand-write a connector per integration. What is MCP? explains the plumbing. One is the ability to order; the other is a common ticket format every kitchen accepts.

"More tools means a more capable agent." Each tool definition is tokens in the prompt, and every extra option is one more thing the model can pick wrongly. Anthropic publishes the overhead honestly: on Claude Sonnet 4.5, enabling tool use adds a 496-token system prompt before your tools and their schemas are counted on top. Researchers at UC Berkeley built the Berkeley Function Calling Leaderboard (BFCL) around exactly this failure class — wrong function, wrong arguments, and the case where no listed function fits and the model should decline. Current BFCL rounds add multi-turn and agentic tasks, plus cost and latency per model, because a correct call that takes nine round trips is its own kind of failure.

"A tool call is trustworthy output." It is a proposal shaped like a request. A tool's result is also untrusted text as far as the model is concerned, which is how a poisoned page or a doctored file can steer the next call — the same hazard as prompt injection. Treat the arguments as input, not as instruction.

Where to learn more

Start with OpenAI's original function-calling announcement for the concept, Anthropic's tool-use documentation for the round-trip mechanics (parallel calls, forced choice, result blocks), and the BFCL leaderboard and its code for what "correct" actually means in practice. Then build the smallest real thing: one tool, one question that needs it, and print the call the model makes before you execute anything.

Related reading: What is MCP? · What is an AI agent?

Which tool call would you want a confirmation prompt before an AI ever made — and which should just run? Tell us in the comments.