What is tool calling (function calling)?
Tool calling lets a model decide, mid-response, to call one of your functions, returning structured arguments your code runs. It's how a model reaches past text into the real world.
The short version
Out of the box a model can only produce text. Tool calling: also called function calling (they’re the same thing), gives it a way to act: you describe some functions it’s allowed to use, and when one would help, the model stops writing prose and instead returns a structured request: a function name and a set of JSON arguments. Your code runs the real function and hands the result back. The model never executes anything itself; it asks, and your program decides whether and how to carry it out.
The flow, step by step
- Declare the tools. You pass the model a list of functions, each with a name, a description, and a JSON Schema for its parameters.
- The model decides. Given the conversation, it either answers normally or emits a
tool call:
get_weather({ "city": "Miami" }). - Your code executes. You run the actual
get_weatherfunction, call an API, query a database, do a calculation. - Feed the result back. You return the function’s output to the model, which uses it to write its final answer (or call another tool).
That last loop, call a tool, read the result, decide what’s next, repeated until the task is done, is the core of an agent.
Why it matters
- It connects the model to reality. Live data, private systems, actions, exact math, all the things a text-only model can’t do reliably on its own.
- It’s the basis of agents. “Agentic” behavior is mostly a model choosing tools in a loop.
- The arguments are structured. Because the model must produce JSON that fits your schema, tool calling is a structured-outputs problem under the hood.
How it relates to MCP
They fit together. Tool calling is the model deciding to invoke a tool. MCP is the standard for describing and connecting those tools so they’re reusable across apps. Function calling is the model raising its hand; MCP is the wiring that lets any tool be on the other end.
Validate what comes back
The model chooses the arguments, and it can choose wrong, a hallucinated ID, an out-of-range value, a call you didn’t expect. Treat a tool call as untrusted input: validate arguments against your schema, check permissions, and never let a model trigger a destructive or irreversible action without a guard. The model proposes; your code disposes.
FAQ
Does the model run my code?
No. It only produces a structured request naming the function and arguments. Your application executes it, which is exactly why you stay in control of what’s allowed.
Is “function calling” different from “tool calling”?
No, they’re two names for the same mechanism. Providers use slightly different wording, but the idea (model returns a structured call, you execute it) is identical.
Can a model call several tools at once?
Yes, many models can request multiple (even parallel) tool calls in one turn, and agents commonly chain calls across several turns.
Related
Tools are standardized by MCP; arguments are structured outputs, build schemas with the Structured Output Builder.