What is tool calling (function calling)?

Tool calling, function calling and tool use name the same thing: the mechanism by which a language model stops merely writing and asks for something to be done outside itself, like checking inventory, searching a catalog or calculating shipping. Anthropic calls it tool use and treats it as a synonym of function calling.⁠^{[1]Anthropic, Claude documentation. Tool use with Claude} It is not a protocol or a plugin you install: it is a capability of the model, and it is the piece underneath any AI agent and any connector. It matters to a store because an assistant that talks about your products with up-to-date data has almost always asked a tool for them, and what that tool returns is what the assistant ends up saying.

How it works

OpenAI defines it as the way its models connect to external systems and access data that was not in their training, and describes it in five steps:⁠^{[2]OpenAI, API documentation. Function calling}

1. The application makes a request to the model with the tools it could call.
2. The model responds with a tool call: which function and with what arguments.
3. The application runs its own code with those arguments.
4. The application makes a second request to the model with the result.
5. The model answers the user, or asks for another tool.

Step 3 is the one most often misunderstood. The model does not run the function: Google underlines it in its documentation for Gemini, and asks you to extract the name and arguments and run it in your application.⁠^{[3]Google AI for Developers. Function calling with the Gemini API} In Anthropic's API, when Claude wants to use a tool you defined, the response stops with the reason tool_use; your code does the operation and returns a tool_result block with what it got.⁠^{[1]Anthropic, Claude documentation. Tool use with Claude} The exception is server tools, like Anthropic's web search, which run on the provider's infrastructure and not on yours.⁠^{[1]Anthropic, Claude documentation. Tool use with Claude}

What a tool carries

A function is declared with a name, a description of when and how to use it and a JSON schema with the parameters it accepts. In OpenAI, strict mode (strict) makes calls always conform to the schema, instead of trying without a guarantee.⁠^{[2]OpenAI, API documentation. Function calling}

The description is not a comment for programmers: it is what the model reads to decide whether to call the tool. Claude decides when to use it based on the user's request and the tool's description.⁠^{[1]Anthropic, Claude documentation. Tool use with Claude} OpenAI gives three pieces of advice any store can follow: clear, detailed names and descriptions; few functions at a time, fewer than 20 at the start of each turn, because it gets more accurate; and the "intern test," which means asking whether a person could use the function with only what you have given the model.⁠^{[2]OpenAI, API documentation. Function calling} The definitions, besides, are injected into the model's instructions and count as input tokens.⁠^{[2]OpenAI, API documentation. Function calling}

Who decides whether a tool is called is also configurable. Auto mode lets the model choose between calling a function or answering directly; other modes force it to call one or forbid it.⁠^{[3]Google AI for Developers. Function calling with the Gemini API} And a single turn can bring several calls in parallel, unless the application turns that off.⁠^{[2]OpenAI, API documentation. Function calling}

Reading or acting

Google groups the uses into three: extending knowledge (querying databases or APIs), extending capabilities (a calculation, a chart) and acting on other systems, like scheduling an appointment, creating an invoice or sending an email.⁠^{[3]Google AI for Developers. Function calling with the Gemini API} OpenAI's guide to building agents separates tools the same way, data tools, which bring context, from action tools, which change records or send messages, and asks you to assign each tool a low, medium or high risk depending on whether it only reads or also writes, whether its effect can be undone, what permissions it requires and what financial impact it has.⁠^{[4]OpenAI. A practical guide to building agents}

In a store

A fictional example: a coffee maker store offers its assistant a single tool, check_stock. This is how it declares it, in the format model APIs use:⁠^{[2]OpenAI, API documentation. Function calling}

{
  "type": "function",
  "name": "check_stock",
  "description": "Returns the inventory and delivery time of a product by its SKU. Use it when the customer asks whether it is in stock or when it will arrive.",
  "parameters": {
    "type": "object",
    "properties": {
      "sku": {
        "type": "string",
        "description": "Product code, for example MOKA-6-STEEL"
      },
      "zip_code": { "type": "string", "description": "Delivery ZIP code" }
    },
    "required": ["sku", "zip_code"],
    "additionalProperties": false
  },
  "strict": true
}

A customer asks: "Do you have the six-cup stainless steel moka pot, and can it get to Seattle by Friday?" The model does not answer yet: it returns check_stock with {"sku": "MOKA-6-STEEL", "zip_code": "98101"}. The store's application queries its system, gets "12 units, delivery Wednesday" and passes it to the model, which then writes the answer. Every fact in that sentence came from the tool, not the model. If the store's system returns yesterday's stock, the assistant will state yesterday's stock with all the confidence in the world.

Notice two details. The ZIP code is required, so the model has to get it from the conversation. And the tool only reads: creating the cart would be another function, with another risk.⁠^{[4]OpenAI. A practical guide to building agents}

How to check it

1. Ask for the list of tools from whoever sells you an assistant or a connector for the store: name, description and parameters of each. If they cannot show it to you, you do not know what it does.⁠^{[2]OpenAI, API documentation. Function calling}
2. Classify each tool as read or act and give it a risk depending on whether it writes, whether it can be undone, what permissions it uses and how much money it moves.⁠^{[4]OpenAI. A practical guide to building agents}
3. Run the intern test on each description: if a person could not use it with just that text, the model cannot either.⁠^{[2]OpenAI, API documentation. Function calling}
4. Send an incomplete request (no size, no address) and see whether the assistant asks or fills the gap on its own.⁠^{[1]Anthropic, Claude documentation. Tool use with Claude}
5. Check that every action asks for confirmation: the MCP specification recommends that there always be a person able to reject a call and that the application show which tools are being invoked.⁠^{[5]Model Context Protocol. Tools (Model Context Protocol, specification 2026-07-28)}

Related concept: MCP

Tool calling happens inside an application: the developer describes their functions to the model and runs the calls. MCP solves something else: a server publishes its tools once and any compatible application discovers them with tools/list and invokes them with tools/call. In that flow, the model keeps doing the same thing, choosing the tool, and it is the MCP client that sends the call to the MCP server and returns the result to the model.⁠^{[5]Model Context Protocol. Tools (Model Context Protocol, specification 2026-07-28)} Without tool calling, MCP would have nobody to choose; without MCP, every tool is rewritten for every application.

To keep going, autonomous vs. assisted agents explains who approves the calls that act, agentic commerce covers what a shopping agent uses them for, and the reading path orders the rest of the terms.