function calling
Tool use is the mechanism by which a language model, which can only ever generate text, reaches outside itself to search a database, run code, or call an API — by emitting a structured call that names a registered function and its arguments, handing control to a surrounding program that actually executes the action and hands back a result the model can read. OpenAI shipped the first mainstream version of this as "function calling" in June 2023; Anthropic's Claude followed with a native tool-use API the same year, and by November 2024 Anthropic had generalized the idea into the Model Context Protocol (MCP), an open standard for connecting models to tools that OpenAI adopted into its own Agents SDK in March 2025 and Google DeepMind added support for shortly after. The sequence below is the loop every one of these implementations runs underneath.
The contract is a typed schema, not a suggestion. Every tool is registered with a name, a natural-language description, and a JSON Schema listing required and optional parameters and their types; OpenAI's function-calling spec and Anthropic's tool-use spec both use this same shape, which is why a single prompt describing "get_weather(city: string, units: enum[c,f])" is enough for the model to produce a syntactically valid call on the first attempt in the overwhelming majority of cases on both platforms' published benchmarks. Get the schema wrong — missing a required field, using the wrong enum value — and the host rejects the call before anything external runs, which is the main defense against the model inventing arguments.
The host, not the model, decides what actually happens. The language model only ever proposes a call; a separate runtime — the application built around the model — checks that call against a permission scope before executing anything, which is why a coding agent can be given access to `read_file` without also being given `delete_file`, and why a production deployment typically gates irreversible actions (sending an email, charging a card, pushing to main) behind an explicit human-approval step rather than a scope the model can self-grant. This separation is also what keeps a compromised or hallucinating model from directly harming anything outside its sandbox.
Before MCP, every model-tool pairing needed its own glue code. A team supporting GPT-4's function calling, Claude's tool use, and Gemini's function calling each had to write and maintain three separate integration layers for the same underlying tool, because each vendor's calling convention differed slightly. The Model Context Protocol replaced that N-times-M integration problem with one client-server protocol: a tool exposed once as an MCP server can be called by any MCP-compliant client, the architecture compared below.
Failures have to stay inside the loop, not become silent successes. A tool call can legitimately fail — the API times out, the file doesn't exist, the database rejects the query — and a well-built agent harness returns that failure as a structured observation rather than crashing or, worse, letting the model fabricate a plausible-sounding result it never actually obtained; the model then gets a chance to retry with corrected arguments or a different tool within a bounded retry budget. Anthropic's own tool-use documentation and OpenAI's function-calling guidance both specify this explicitly: error messages are returned to the model as a normal turn in the conversation, not swallowed by the application layer.
Tool use is the hinge that turns a model from something that only talks about the world into something that can act in it under supervision, and the entire history of the feature — from bespoke function-calling schemas in 2023 to a shared protocol like MCP by 2024–2025 — is the industry converging on one answer to the same question: how do you let a model request an action without ever letting it skip the check that decides whether that action is allowed to happen.