In one sentence
A model feature where the AI returns a structured request to run a defined function, which your code runs and returns.
Tool calling, also called function calling, lets an AI model ask your software to do something. You describe each tool to the model with a name, a purpose and a schema for its inputs. When the model decides a tool is needed, it returns a structured request, such as "look up order 4471". Your code checks the request, runs the real function and sends the result back. OpenAI and Anthropic both document this pattern for their models.
The model never runs the tool itself
It only proposes a call. That gap is where control lives: your code can validate inputs, check permissions, ask a person for approval, or refuse. This is the main reason tool calling is safer than letting a model write and run its own code.
Good tool design
keeps each tool narrow and clearly named. "Get appointment by ID" is safer and easier for the model to use correctly than "run any database query". Inputs should have strict types and allowed values. Tools that change data should be separate from tools that read it, so read-only agents never see write tools.
Relation to MCP
The Model Context Protocol is a standard way to package tools so many AI applications can discover and call them. An MCP server exposes tools; the AI host turns them into tool calls for the model. Tool calling is the model feature; MCP is the plumbing that makes tools portable.
Failure handling
Tools fail: timeouts, missing records, rate limits. Return clear error messages the model can act on, cap the number of calls per task, and make write tools idempotent so a retry does not create duplicates.
In our builds
every tool an agent can call is listed, typed and logged, and tools that move money or send outside messages require approval by default.
Keep following the system
Model Context Protocol (MCP)
An open standard for connecting compatible AI applications to tools, resources, and prompts.
AI Agent
A system that uses a model and tools to pursue a goal across multiple steps within defined permissions and review boundaries.
Idempotency
The property that doing the same operation twice has the same effect as doing it once, so retries do not create duplicates.
Webhook
An HTTP message one system sends to another the moment an event happens, so the receiver does not have to keep asking.
Retrieval-Augmented Generation (RAG)
A method where an AI system first looks up relevant documents and then writes its answer using them.