Function Calling (Tool Use)

Function calling — Anthropic calls it tool use — is the mechanism that lets a language model act instead of only writing text. Given a set of tool definitions (a name, a description, and a JSON-Schema for the parameters), the model decides whether a tool is needed and, if so, emits a structured call: the tool name plus JSON arguments that conform to the schema. Critically, the model never runs code itself. It only requests a call; the host application executes the function and returns the result.

The loop

1. The app sends the user message plus the tool schemas to the model.
2. The model returns either normal text or a tool-call request.
3. The app validates the arguments, executes the function, and returns the output.
4. The model uses that output to answer or to call again. Multi-turn and parallel tool calls are supported.

How the providers expose it

• OpenAI — originally functions/function_call in mid-2023, now the tools parameter with type: "function" (each tool has name, description, and a parameters JSON Schema); the model returns tool_calls. It supports strict schema adherence and parallel calls.
• Anthropic — pass a tools array (each with name, description, and input_schema) to the Messages API; Claude returns a tool_use content block with structured input, and the app replies with a tool_result block. Same loop, different field names.

Relationship to MCP Function calling is the model-level capability: a single application defines a tool's schema and runs its own bespoke code. It is per-app, ad hoc, and not interoperable. The Model Context Protocol sits one layer above — it standardizes how tools and data are discovered, described, and connected via a reusable JSON-RPC client/server protocol, solving the "M×N integrations" problem. MCP does not replace function calling; it feeds it. An MCP server advertises tools that the host then exposes to the model through its native function-calling interface. In short: function calling is how one model invokes one tool; MCP is a standard way to connect many hosts to many tools.

For the wider picture see What Is the Model Context Protocol and the agent-protocols overview. Note that untrusted tool descriptions and tool outputs are both attack vectors — see MCP Security Risks.