Tool calling

Definition

Tool calling lets a model request information or action through declared interfaces. The request remains a proposal until trusted software validates identity, standing, policy, arguments, limits, approvals, and expected effects before execution.

Tool-call interfaces are widely available; authorization, semantic safety, and cross-tool composition remain active risk areas.

Why it matters

Tools convert language output into environmental effects.

The security boundary belongs at the executor and policy enforcement point, not in a tool description or model instruction alone.

System anatomy

Tool contract

A narrow name, purpose, typed input, and typed result.

Policy check

An external allow, deny, hold, or escalation decision.

Executor

Code that performs the validated operation.

Evidence

Recorded request, decision, effect, and result.

Important distinctions

Authority

The ability to form a tool call does not grant permission to execute it.

Model Context Protocol

Tool calling is an interaction pattern; MCP is one protocol for exposing capabilities.

Implementation signals

• Use narrow schemas and least privilege
• Validate arguments and postconditions outside the model
• Make high-impact tools reversible or approval-gated

Failure modes

• A broad shell or database tool with borrowed credentials
• Tool output injected back as trusted instructions

Sources and further study

1. OpenAI — A practical guide to building agents

   Defines a practical agent around a model, tools, instructions, and a run loop that continues until an exit condition is reached.

   Use in this library: Primary definition. The guide is first-party product guidance and a simplified starting architecture, not a complete regulated-enterprise control model.

   guidance · guidance · Published 2025
2. Model Context Protocol — Model Context Protocol architecture overview

   Documents the host, client, server, capability-negotiation, and message layers used to connect AI applications with context and tools.

   Use in this library: Standard or protocol. Protocol connectivity and capability discovery do not confer business authority, validate tool output, or make a server trustworthy.

   protocol · protocol · Published 2026-07-28
3. OWASP GenAI Security Project — OWASP Top 10 for Agentic Applications 2026

   A threat-oriented reference for goal hijacking, tool misuse, identity abuse, memory poisoning, and cascading agent failures.

   Use in this library: Official guidance. Guidance describes recommended practice; citation does not prove that a control is implemented or effective in a particular environment.

   guidance · guidance · Published 2025-12