Function calling

Function calling (also called tool calling or tool use) lets an AI model ask your software to do something. You describe the actions it may request, such as "look up an order". When a customer asks a webshop assistant where their parcel is, the model requests that lookup, your system runs it, and the model answers with the actual status. Your software decides what really runs.

Where does the term come from?

OpenAI added function calling to its Chat Completions API on 13 June 2023: new versions of GPT-4 and GPT-3.5 Turbo were fine-tuned to detect when a function was needed and to reply with a JSON object holding the arguments. Anthropic made the same idea generally available as tool use for its Claude 3 models on 30 May 2024, and Google's Gemini API also calls it function calling.

How does it work?

OpenAI's function calling guide describes five steps:

1. Your application sends the question to the model with the tools it may call: for each tool a name, a description of what it does and when to use it, and its parameters as a JSON Schema.
2. The model answers directly or calls a tool. A call holds the tool name and the arguments as JSON.
3. Your application runs the function with those arguments, for example a database query.
4. It sends the result back to the model in a second request.
5. The model writes its answer from the result, or asks for another call.

Anthropic calls this a contract between your application and the model: "The model never executes anything on its own." Repeat steps 2 to 5 until the model gives a final answer, and you have the basic loop of an AI agent.

The model can request several calls in one turn (parallel calls), which you can switch off. The tool_choice parameter can require a call or force one specific function, for example to extract structured data from a text. In September 2026 Anthropic's documentation lists Claude Opus 5.5 among the models that refuse a forced call. With strict mode (strict: true) the arguments always match your schema, as with structured output.

How does it relate to MCP?

Function calling is how the model asks for an action. The Model Context Protocol (MCP), which Anthropic published in November 2024, standardises how an application finds and reaches tools on external servers. In the MCP client tutorial the client fetches the tool list from an MCP server, passes it to Claude as ordinary tool definitions, and runs Claude's tool calls through that server. An MCP tool reaches the model through function calling.

Where does it go wrong?

• Instructions hidden in tool results. At the 2023 launch OpenAI warned that untrusted data in a tool's output can instruct the model to perform unintended actions, a form of prompt injection. Its advice: use trusted tools only, and let the user confirm actions with real-world impact, such as sending an email or making a purchase (human-in-the-loop).
• Guessed values. If a required parameter is missing from the question, the model may fill in a plausible one. Anthropic's example is "What's the weather?" without a location: some Claude models ask, others guess.
• Vague descriptions. Anthropic calls detailed tool descriptions "by far the most important factor in tool performance". OpenAI advises fewer than 20 functions at the start of a turn.
• Cost and speed. Tool definitions are billed as input tokens, and every call adds at least one round trip.

Example

Suppose a webshop gives its customer service assistant one function, here in OpenAI's format (Anthropic names the schema field input_schema):

1
{
2
  "type": "function",
3
  "name": "get_order_status",
4
  "description": "Look up the shipping status of an order by its order number.",
5
  "parameters": {
6
    "type": "object",
7
    "properties": {
8
      "order_id": {"type": "string", "description": "The order number"}
9
    },
10
    "required": ["order_id"]
11
  }
12
}

A customer writes: "Where is my order 1042?" The model replies with a call to get_order_status with {"order_id": "1042"}. The shop's code looks the order up and returns {"status": "shipped", "carrier": "PostNL"}, and the model answers: "Your order 1042 has shipped with PostNL." Cancelling an order would need a separate function, and the shop's code can hold that call until a staff member approves it.