Function Calling — AI Glossary

Reference details

Related terms

• Tool Use
• AI Agent
• MCP (Model Context Protocol)
• JSON Mode (Structured Output)

How it works

1. Tool schemas are serialised into the request alongside the messages, and the provider renders them into the prompt using whatever format the model was trained on.
2. The model then emits a structured object naming a tool and supplying arguments, and it does so because tool-calling examples were part of its instruction tuning — this is a trained output mode, not text that the harness parses hopefully.
3. The emitted arguments are validated against the schema before anything executes, which is the only stage at which a wrong type or an out-of-range value can be caught.
4. Where the provider supports constrained decoding, the schema restricts which tokens may be sampled, so the arguments are guaranteed to parse rather than merely likely to.
5. Each call carries an identifier, and the result is appended as a message bound to that identifier, which is what lets several calls issued in one turn be resolved in any order.
6. Nothing in this sequence runs anything: the model's output is a request, and execution, sandboxing and authorisation are entirely the harness's work.

Example: What the model actually emits

You pass a schema for get_weather(city, unit). Asked “Is it colder in Oslo or Lisbon?”, the model does not answer from memory — it emits two structured calls, your code executes them, and you return the results for the model to compare. The model never runs anything itself; it only produces the arguments.

// You send the schema; the model returns calls, not prose.
{ "tool_calls": [
    { "name": "get_weather", "arguments": { "city": "Oslo",   "unit": "c" } },
    { "name": "get_weather", "arguments": { "city": "Lisbon", "unit": "c" } }
] }
// Your runtime executes both, appends the results, and asks again.

Commonly confused with

Function calling does not execute anything. The model only produces a name and arguments — running them, sandboxing them and validating them is entirely your responsibility. Treating a tool call as pre-authorised is the root of most agent security incidents.

When to use it

Reach for it when:

• The answer depends on live data the model cannot hold
• You need a typed, machine-parseable action rather than prose
• Several independent lookups can run in parallel in one turn

Reach for something else when:

• You only need a structured answer, not an action — use structured output instead
• The tool surface is large and unfiltered; models pick wrong tools as the list grows
• The call has side effects and nothing stands between the model and production

Referenced by

This term is used by the following ModelRefs references:

• json mode
• function calling prompt
• react
• single tool agent
• multi tool router
• function calling basic
• parallel function calling
• json schema tool call
• rest api tool
• graphql tool
• mcp server integration
• tool router
• single agent stack
• learn agents
• learn prompt engineering
• build ai customer support

Continue your research

Use these connected ModelRefs sections to compare alternatives, inspect implementation paths, and review the evidence and governance boundaries relevant to Function Calling — AI Glossary.

• Browse models
• Review providers
• Inspect benchmarks
• Explore workflows
• Learn AI concepts
• Read decision guides
• Review trust and methodology
• Start a decision path