function calling

in English: function calling / tool calling

advancedwidespread

Function calling is the capability by which a language model not only writes text but also requests an external program or tool to perform a task.

In plain terms

A language model alone can only generate text: it cannot see your calendar, does not know today's exchange rate, and cannot send an email. Function calling breaks down this wall: the model can signal that it now needs an external tool and specify exactly what it requests from it.

It is like the relationship between a waiter and the kitchen. The waiter does not cook, but knows what is on the menu, takes your order, submits it to the kitchen in proper form, and then brings out the food. The model is the waiter, the tools are the kitchen: the model does not calculate, search, or book itself, but submits the "order" and formulates the answer from the result.

This is what turns a chatbot into an acting system. An AI agent is essentially a system where the model performs many function calls in sequence: it searches, reads files, runs code, and after each result decides what the next step should be.

How it works

The developer provides the model with a list of available tools: each has a name, a short description, and the data it expects (for example, city and date).
When you ask something, the model decides whether it can answer on its own or needs a tool.
If a tool is needed, the model does not write an answer but a standard, machine-readable request: which tool to call and with what data.
The request is not executed by the model itself, but by the program surrounding it: that program runs the search, calculation, or booking and returns the result to the model.
The model writes the answer based on the result, or calls another tool if the task requires multiple steps.

An everyday example

You ask the assistant whether you need an umbrella in Szeged tomorrow. The model cannot know this from memory, so it calls the weather service with "Szeged, tomorrow" data and formulates the answer based on the received forecast. The same happens when a chatbot searches the web or enters an appointment into your calendar.

Who is affected

developerThis is how you connect the language model to your own systems, databases, and services. → Code

entrepreneur, executiveThis determines whether the AI only gives advice or actually performs tasks in corporate systems, and the question of liability goes along with it.

employeeOffice assistants access your emails, calendar, and documents through this, so it is worth knowing what access you granted. → Work & HR

everyoneWhen a chatbot searches the web, calculates, or books on your behalf, function calling occurs in the background.

A common misconception

MythThe model runs the programs itself and directly intervenes in your systems.

In realityThe model only formulates a request; what is executed from this and with what permissions is decided by the surrounding program and its settings. The risk therefore depends on what tools and permissions the system has been granted.

Limits and risks

The model can make mistakes: it may choose the wrong tool, provide incorrect data, or call a tool when it is not needed.
An instruction hidden in a web page or email can trick the model into making an unwanted tool call (this is called prompt injection), so the content it reads is not a trustworthy source of commands.
For irreversible operations, such as payment, deletion, or sending an email, it is advisable to request human approval before execution.
The more tools a model receives at once, the more easily it confuses them, and the more expensive and slower its operation becomes.

Similar, but not the same

AI-agent – Function calling is a mechanism for single tool use, while an agent is a system that independently progresses toward a goal through a series of such calls.
Model Context Protocol (MCP) – MCP is a standard for connecting tools to models uniformly, while function calling is the capability that allows the model to use these tools.
structured output – With structured output, the model provides only a fixed-format response; with function calling, the output triggers an operation whose result is returned to the model.

Related concepts

Broader

large language model, generative AI, tool use

Narrower

parallel function calling, web search, code execution, computer use

On the edge

AI-agent, Model Context Protocol, API, structured output, prompt injection

A brief history

The term was popularized by OpenAI in June 2023, when it added function-calling capabilities to the programming interface of its GPT models. Other major model developers also introduced the feature, mostly under the names "tool use" or "tool calling". In November 2024, Anthropic published the Model Context Protocol, which standardizes how tools are connected, and in December 2025 it handed it over to the Agentic AI Foundation, operating under the Linux Foundation.

Where things stand

At the end of 2026, virtually every major language model has this capability, and chatbots' search, code-execution and office functions, as well as AI agents, are built on it. Reliability has improved significantly, but security, especially protection against hidden instructions, remains an open question.

Status: 2026 November

In the news

Appears in 3 Agent Age stories; the curve shows weekly occurrence in the news magazine.

AI tool use causes privacy incidents at Washington mental health facilities and Weill Cornell radiologyNov 2, 2026 · Health
Chinese AI tool used against South Korean banks also hit Japanese companiesOct 18, 2026 · Agent Age
Chinese Qwen search tool removed from US Federal Register site; Alibaba releases new Qwen image modelSep 17, 2026 · Agent Age

Also known as

function calling · tool calling · tool use · function calling · function calling · tool calling · tool use · function call

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.