Loading lesson…
Applied LLM Systems: RAG, Agents & MCP / Agents and Tools
Letting a model act.
Reviewed by Yuvaraj
A model on its own can only produce text. It cannot look up today's price, run a calculation it is unsure of, or write to a database. Tool use, often called function calling, is the mechanism that lets it do those things: the application hands the model a menu of functions, and the model can ask for one to be run.
The key idea is that the model does not run anything itself. The cycle is:
Answer from memory before revealing, retrieval practice is what builds durable recall.
What does function calling let a language model do?
Ask about this lesson, or about anything in AI. Answers cite the lessons they draw on.
Finished this lesson?
Mark it complete to earn XP, keep your streak, and schedule a review.
So "function calling" is really the model requesting a call. The application stays in control of what actually executes, which is exactly where safety lives.
Suppose the app exposes one tool:
{
"name": "get_weather",
"description": "Get the current weather for a city",
"parameters": {
"type": "object",
"properties": { "city": { "type": "string" } },
"required": ["city"]
}
}
Asked "what should I wear in Paris today?", the model does not guess the weather, it emits a request:
{ "name": "get_weather", "arguments": { "city": "Paris" } }
The application validates that city is a string, runs the real function, and feeds the result, say { "tempC": 12, "sky": "rain" }, back into the conversation. Now the model answers, grounded in a real observation rather than a memorized guess.
Selection is driven by the tool descriptions and argument schemas. A clear description ("get the current weather for a city") and a precise schema (city: string) make the right tool easy to pick and the arguments easy to fill. Vague or overlapping tools cause wrong or ambiguous calls. Writing good tool descriptions is a real part of building reliable agents.
Schemas are contracts
The argument schema does double duty: it tells the model how to shape a call, and it lets the application reject a malformed one before anything runs. Validate every argument as untrusted input, a model can produce a call that is well-formed but wrong.
Function calling is what makes the agent loop from the previous lesson possible: "act" almost always means "call a tool." An agent is, in large part, a model with tools and a loop that keeps calling them until the goal is met.
Excessive agency is a security risk
Every tool you expose widens what a model can do, including things you did not intend if the prompt is manipulated. Grant the least privilege a task needs, keep destructive actions behind confirmation, and never let tool output be trusted as if it were your own instructions. This is a recognized class of risk in the OWASP Top 10 for LLM Applications.
A fast-moving interface
The concept, a model requesting a validated, schema-typed function call, is stable across providers. The exact request format, field names, and streaming behavior differ by provider and change often. Treat any specific API shape as versioned implementation detail, and check the current provider documentation.