# Tool use (function calling)

The capability that lets a language model invoke external functions, APIs, or programs in a structured way during generation, forming the basic mechanism by which AI agents interact with the world beyond text.

Tool use, also called function calling, is the capability that lets a [large-language-model](https://www.wikiprompt.org/wiki/large-language-model) invoke an external function, API, or program in a structured way as part of generating a response. Instead of producing only natural-language text, a model with tool use can output a structured request, typically formatted as something resembling a function call with named arguments, which a surrounding application executes on the model's behalf; the result is then returned to the model, often inserted back into its [context-window](https://www.wikiprompt.org/wiki/context-window), so it can incorporate that information into its final answer or decide on a further action. Tool use is the basic mechanism by which an [ai-agent](https://www.wikiprompt.org/wiki/ai-agent) interacts with anything outside its own text generation, including databases, calculators, search engines, code execution environments, and other software.

## Development

Early language models could only produce plain text, so any interaction with external systems had to be handled by parsing free-form output and hoping it matched an expected pattern, an unreliable approach. Structured function calling was introduced as a first-class model feature by major labs starting in 2023, with providers training models specifically to emit well-formed calls to a set of tools described in the prompt, along with matching schemas that constrain the arguments a call can contain. This made tool use dramatically more reliable and turned it into a standard capability across essentially all frontier chat and API models by 2024, alongside broader efforts, including [anthropic](https://www.wikiprompt.org/wiki/anthropic)'s [model-context-protocol](https://www.wikiprompt.org/wiki/model-context-protocol) introduced in November 2024, to standardize how tools are described and connected to models across different vendors and applications.

## How it works in practice

A typical tool-use exchange has three parts. First, the calling application describes the available tools to the model, usually as a list of function names, descriptions, and expected argument types, included in or alongside the [prompt](https://www.wikiprompt.org/wiki/prompt). Second, when the model determines that answering the user's request requires information or an action it cannot produce on its own, such as looking up current data or performing a precise calculation, it emits a structured call to the relevant tool rather than a natural-language answer. Third, the application executes that call outside the model, and the result is fed back into the conversation, after which the model can use it to compose a final answer or issue another call. This loop can repeat many times within a single agentic task, and models are typically trained to decide independently when a tool call is needed versus when they can answer directly from their own knowledge.

## Applications

Tool use underlies a wide range of practical systems: a model can be given a web search function to answer questions about recent events, a code execution tool to run and verify a calculation or a piece of generated code, a database query tool to look up specific records, or an API call to take an action such as sending a message or updating a record in an external system. It is also the foundation of [retrieval-augmented-generation](https://www.wikiprompt.org/wiki/retrieval-augmented-generation) pipelines that expose retrieval as a callable tool, and of [computer-use](https://www.wikiprompt.org/wiki/computer-use) systems, where the "tool" is control over a graphical interface such as a mouse and keyboard rather than a narrow API.

## Reliability and safety

Tool use introduces failure modes that plain text generation does not have, since a model can call the wrong tool, supply malformed or hallucinated arguments, or call a tool an unusually large number of times in a loop. Because tool calls can have real-world side effects, ranging from sending an email to executing arbitrary code, tool use also raises distinct safety questions, including how to prevent a model from being manipulated by adversarial content into misusing an available tool, an attack pattern closely associated with [prompt-injection](https://www.wikiprompt.org/wiki/prompt-injection). Production systems typically address this with permission scoping, human confirmation steps for consequential actions, and sandboxing of any tool that executes code or accesses sensitive data.

---
Source: https://www.wikiprompt.org/wiki/tool-use
License: CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/)
Last updated: 2026-09-02T20:29:35.44924+00:00