What is function calling?
Function calling, also called tool calling, is the capability that lets a language model use tools outside itself. On its own, a model can only produce text. Function calling gives it a disciplined way to say "run this tool with these inputs" so your program can act on the request.
The important part: the model never runs anything. You give it a list of functions it may use. Each one has a name, a plain description, and a schema for its parameters. When the model decides a task needs one, it stops writing a normal answer. Instead it returns a structured call: the function name plus its arguments as JSON. Your application executes that function against your code, API, or database, then hands the result back. The model reads the result and either answers or calls another tool.
In short: the model decides what needs to happen and with which inputs. Your code decides whether to do it, and actually does it.
In plain words
Think of the model as a sharp colleague on the phone who cannot touch any of your systems directly. When they need today's exchange rate or a meeting booked, they cannot act on their own. They tell you exactly what to run, you carry it out, and read the answer back. They decide what needs doing; you are the hands that do it. Function calling is that phone call, written in a format your program can follow without guessing.
How function calling works
A single round of function calling has a clear shape:
- You describe the tools. Each function gets a name, a short description of what it does, and a schema of its parameters. That description is all the model knows about the tool.
- The model receives the request and the tool list. It reads the user's message and the tools available to it.
- The model decides. If plain text is enough, it answers. If a tool is needed, it returns a structured call instead: the function name and arguments as JSON, for example
get_weather({ city: "Prague" }). - Your application executes it. This step is entirely your code. You run the function, call the real API, or query the database. You also decide whether the call is even allowed.
- The result goes back to the model. It reads what came back and continues, either writing the final answer or calling another tool.
That last loop is the whole trick. One request can trigger several tool calls in a row, each informed by the last. The model still only ever produces text. Function calling is just a strict format for part of that text, so your program can act on it reliably instead of parsing prose.
Why it matters
- It turns a text generator into something that can act. Without tools, a model can only describe what it would do. With function calling, it can fetch, calculate, and trigger real work. Every AI agent is built on this.
- It connects the model to live and private data. A model only knows what it saw during training. Function calling lets it call your systems for today's numbers, a customer's order, or an internal document.
- The hand-off is structured, not guesswork. Arguments arrive as validated JSON matching a schema you defined, not as a sentence you must interpret. That makes the integration far more reliable.
- It is the mechanism behind tool use, agents, and MCP. An agent is function calling running in a loop until the goal is met. The Model Context Protocol standardizes how tools are described and exposed, so the same tools work across models and clients.
Common pitfalls
- The model can pick the wrong tool or invent arguments. Validate every call against your schema before you run it. Never trust the arguments just because they came from the model.
- You own the consequences, not the model. A model requesting
delete_recordsdoes not make deleting safe; your code runs it. Gate anything irreversible behind explicit checks or human approval. - Exposing tools widens your attack surface. A prompt injection can trick the model into calling a tool with attacker-chosen arguments. Enforce access control in your own code, tied to the real user.
- Vague descriptions cause wrong calls. The function name, description, and parameters are the model's whole interface to the tool. Treat them like API docs.
- More tools is not better. A long list makes the model slower, costlier, and worse at choosing. Keep the toolset small and relevant.
Related articles:
- What's an agent? - An agent is function calling running in a loop: the model calls a tool, reads the result, and calls the next one until the job is done.
- What is agentic AI? - The broader paradigm where models plan and act on their own, with function calling as the mechanism that lets them act.
- What is an LLM? - The language model that decides which function to call and with what arguments.
- What is prompt injection? - The main security risk of giving a model tools, and why access control belongs in your code, not the prompt.
Want to stay one step ahead?
Don't miss our best insights. No spam, just practical analyses, invitations to exclusive events, and podcast summaries delivered straight to your inbox.