Tool use, also called function calling, is the capability that lets a Large language model invoke an external function, API, or program in a structured way as part of generating a response. Instead of producing only natural-language text, a model with tool use can output a structured request, typically formatted as something resembling a function call with named arguments, which a surrounding application executes on the model's behalf; the result is then returned to the model, often inserted back into its Context window, so it can incorporate that information into its final answer or decide on a further action. Tool use is the basic mechanism by which an AI agent interacts with anything outside its own text generation, including databases, calculators, search engines, code execution environments, and other software.
Development
Early language models could only produce plain text, so any interaction with external systems had to be handled by parsing free-form output and hoping it matched an expected pattern, an unreliable approach. Structured function calling was introduced as a first-class model feature by major labs starting in 2023, with providers training models specifically to emit well-formed calls to a set of tools described in the prompt, along with matching schemas that constrain the arguments a call can contain. This made tool use dramatically more reliable and turned it into a standard capability across essentially all frontier chat and API models by 2024, alongside broader efforts, including Anthropic's Model Context Protocol introduced in November 2024, to standardize how tools are described and connected to models across different vendors and applications.
How it works in practice
A typical tool-use exchange has three parts. First, the calling application describes the available tools to the model, usually as a list of function names, descriptions, and expected argument types, included in or alongside the Prompt. Second, when the model determines that answering the user's request requires information or an action it cannot produce on its own, such as looking up current data or performing a precise calculation, it emits a structured call to the relevant tool rather than a natural-language answer. Third, the application executes that call outside the model, and the result is fed back into the conversation, after which the model can use it to compose a final answer or issue another call. This loop can repeat many times within a single agentic task, and models are typically trained to decide independently when a tool call is needed versus when they can answer directly from their own knowledge.
Applications
Tool use underlies a wide range of practical systems: a model can be given a web search function to answer questions about recent events, a code execution tool to run and verify a calculation or a piece of generated code, a database query tool to look up specific records, or an API call to take an action such as sending a message or updating a record in an external system. It is also the foundation of Retrieval-augmented generation pipelines that expose retrieval as a callable tool, and of Computer use (AI) systems, where the "tool" is control over a graphical interface such as a mouse and keyboard rather than a narrow API.
Reliability and safety
Tool use introduces failure modes that plain text generation does not have, since a model can call the wrong tool, supply malformed or hallucinated arguments, or call a tool an unusually large number of times in a loop. Because tool calls can have real-world side effects, ranging from sending an email to executing arbitrary code, tool use also raises distinct safety questions, including how to prevent a model from being manipulated by adversarial content into misusing an available tool, an attack pattern closely associated with Prompt injection. Production systems typically address this with permission scoping, human confirmation steps for consequential actions, and sandboxing of any tool that executes code or accesses sensitive data.