What is tool calling?

Short answer

Tool calling is the mechanism by which a model asks the surrounding application to run a function. The developer supplies tool names, descriptions and JSON schemas; the model returns a structured call with arguments; the application executes it and returns the result for the next turn. The model never executes anything itself. Every real capability, and every real risk, comes from what the application is willing to run on its behalf.

How it works

Schemas do two jobs. They constrain the shape of arguments, which providers can enforce during decoding, and they document intent, which is what the model actually reasons over when choosing a tool. Descriptions therefore matter as much as types: two similar tools with vague descriptions produce systematic mis-selection that no amount of retry logic fixes.

Selection accuracy also degrades as catalogues grow. Practical systems keep the exposed set small, group related operations behind one tool, or add a search-and-invoke layer so only relevant tools enter the context.

Example

Given get_invoice(id) and search_invoices(query, date_range), a model asked about "last month's unpaid invoices" should search first. If the descriptions do not make the distinction obvious, it will guess an id — a failure that looks like a model problem and is really an interface problem.

Why it matters

Tool calling is the boundary between a chatbot and a system that acts. It is also the enforcement point: every mutating call should be scoped by the caller's permissions, idempotent under retry, and gated for approval when it spends money or cannot be undone.

Common misunderstandings

That the model runs code. It emits a request; the application decides whether to honour it.

That schema validation makes a call safe. A well-formed call can still be the wrong call, or an attacker's call.

That heavily constrained schemas improve reliability. Very large or tightly bounded schemas are a common source of hard request failures; state limits in the prompt and enforce them in code.