Tool Calling

What is tool calling?

Tool calling is the mechanism through which a model or AI agent requests an external capability. The model selects a tool from the definitions it has been given and produces structured arguments. Application code then validates and executes the request.

The model does not normally perform the external action itself. It proposes the call; the surrounding system controls whether and how it runs.

The tool-calling cycle

A typical cycle is:

1. The application supplies tool definitions to the model.
2. The model decides whether a tool is needed.
3. It returns the selected tool name and arguments.
4. The application checks permissions and validates the input.
5. The tool executes against an external system.
6. The tool result is returned to the agent as an observation.
7. The agent decides the next step.

For example, an agent may request a weather tool with a city and date. The application calls the service, then gives the returned forecast to the model so it can answer the user.

Tool calling versus tool execution

Tool calling is the request. Tool execution is the real operation performed by code, an API, a database, or another system. Keeping them separate is essential for security: a model-generated request should not bypass authentication, input validation, approval rules, or rate limits.

Tool calling is also broader than function calling. A function is one implementation form. A tool may represent a remote API, search engine, browser, code environment, human approval step, or specialized service.

Common failure modes

A model may choose the wrong tool, omit a required argument, invent an unsupported value, or call a tool when a direct answer would be better. A valid call can still fail because the external service is unavailable, access is denied, or the underlying data has changed.

Tool definitions and schemas reduce these errors but cannot eliminate them. Applications need explicit success and failure responses, retry limits, idempotency where relevant, and safe handling of partial completion.

Why it matters

Tool calling lets an agent move beyond generated text. It can retrieve current data, calculate, modify records, send communications, or operate software. Those capabilities make the agent useful, but they also create real-world consequences.

Reliable systems grant the smallest necessary permissions, distinguish read from write actions, require approval for high-impact operations, and log what actually happened. See [Tool Use in AI Agents](/tool-use-in-ai-agents/) for the complete selection, execution, observation, retry, and safety loop.