Ask a chatbot what the weather is in Tokyo and, left to itself, it can only guess from what it learned in training. Ask the same question of an AI agent and it checks a live weather service and tells you. The thing that turns the first into the second has an unglamorous name — tool use, or function calling — and it's the single most important mechanism behind the current wave of "agentic" AI. Here's how it actually works.

The model is the brain, not the hands

The crucial idea is this: a language model never actually does anything itself. It can't browse the web, run code, send an email or query a database. All it can do is produce text. Tool use is the trick that lets that text become action — by having the model output a structured request that other software then carries out.

Think of the model as a very capable colleague on the end of a phone line. They can reason, plan and tell you exactly what to do — "look up order #4471 in the database" — but they can't reach through the phone and do it. Tool use gives them an assistant who can: the model says what it wants done, your software does it, and the result is read back down the line.

The loop, step by step

In practice it works as a short, repeating cycle:

1. You describe the tools. Before the conversation, you give the model a list of the tools it's allowed to use — each with a name, a description of what it does, and a schema for its inputs. For a weather tool that might be: get_weather(city: string).
2. The user asks for something. "What should I pack for Tokyo this weekend?"
3. The model decides. Instead of answering from memory, it recognises it needs live data and emits a structured call — in effect, get_weather(city: "Tokyo") — usually as a small piece of JSON. It does not run anything; it just says what it wants run.
4. Your code runs the tool. The software around the model — the part people call the "harness" — sees that request, actually calls the weather API, and gets back, say, "18°C, rain."
5. The result goes back to the model, which now writes the real answer: "It'll be mild but wet — pack a light jacket and an umbrella."

That's one cycle. The power comes from repeating it. A model can call a tool, look at the result, then call another — search the web, read a page, run a calculation, write to a file — chaining many steps to complete a task no single call could. That loop, run over and over until the job is done, is essentially what an "AI agent" is.

Why this is the foundation of agents

Almost everything exciting and worrying about modern AI runs through this mechanism. An AI that books your travel, a coding assistant that edits files and runs tests, a browser agent that clicks through websites for you — all of them are language models in a tool-use loop, just with different tools wired up. The model supplies the judgement about what to do next; the tools supply the ability to actually do it.

Because every company was inventing its own way of describing tools, an open standard has emerged to connect them — the Model Context Protocol — which lets any model plug into any compatible tool, the way a USB port lets any device plug into any computer. That standardisation has helped agents spread quickly over the past year.

Where it goes wrong

Tool use is powerful precisely because it lets an AI act in the real world — which is also exactly why it's risky, and worth understanding honestly.

• The model can call the wrong thing. It might pick the wrong tool, fill in a parameter incorrectly, or misread a result. More capable models do this less, but none do it never — which is why agents that chain many steps can compound small errors into a wrong outcome.
• Acting is riskier than talking. A chatbot that says something wrong is a nuisance; an agent that does something wrong — deletes the wrong file, sends the wrong email, pays the wrong invoice — has real consequences. The stakes rise the moment a model can take actions.
• It widens the security surface. If an agent reads a web page or an email and then acts on it, a malicious instruction hidden in that content can try to hijack what the agent does — the problem known as prompt injection. Giving a model hands means being careful about what those hands are allowed to touch.

The standard answer to all three is restraint: give agents the narrowest set of tools they need, and keep a human in the loop for anything consequential — a confirmation step before money moves or data is deleted.

The quiet mechanism behind the noise

None of this is flashy. There's no new model architecture here, no benchmark to top — just a disciplined convention for letting a text-prediction engine ask for things to be done on its behalf. But it's the hinge the whole agent era turns on. Every time you hear that an AI can now "use your computer" or "act on your behalf," what's underneath is this same quiet loop: the model decides, the tool acts, the result comes back, and round it goes again.