What is tool use?

Tool use is when you give a model a list of functions it may call, and it responds — instead of with prose — with a structured request to call one.

That is the whole mechanism behind agents, plugins, "connect your data", and every AI feature that does something rather than says something.

What actually happens

This is worth getting exactly right, because people assume the model runs the code. It does not.

You send the prompt and a list of available tools, each with a name, description and parameter schema.
The model replies: I want to call get_weather with {"city": "Ambon"}.
Your code runs the function. The model has executed nothing.
You send the result back as a new message.
The model uses it to answer.

The model never touches your database. It emits a request; your software decides whether to honour it. That gap is the single most important fact about tool use, and it is where all the safety lives.

Why it matters

Tool use fixes the things a text predictor is structurally bad at:

Problem	Tool that fixes it
Cannot do arithmetic reliably	A calculator
Does not know today's date	A clock
Knows nothing after training	Search, or RAG
Cannot see your data	A database query
Cannot act	An API call

Asking a model to compute a number is asking the wrong question of the wrong system. Giving it a calculator is the answer.

Where it goes wrong

Bad descriptions cause bad calls. The model chooses tools from your descriptions. A vague description is a bug, and it will pick wrong.
Wrong arguments. Schemas constrain shape, not sense. {"city": "Ambon"} is valid when the user meant Amsterdam.
It will call things it should not. The model is not evaluating whether an action is wise. If you expose delete_account, treat it as callable.
Returned content is data, not instructions. If a tool returns text from the outside world — a web page, an email, a document — that text can contain instructions aimed at the model. See prompt injection. This is the failure mode people discover late.

The rule that follows

Because your code runs the function, your code is the security boundary. Every authorisation check, every confirmation prompt, every "are you sure" belongs in your handler — never in the prompt.

A model asked nicely not to delete things is not a permission system. It is a suggestion, and it is one adversarial input away from being ignored.

What we addedThe precise account of what the model does and does not do during a tool call — the part that determines where the security boundary sits.

This article was researched and drafted with AI assistance from the sources listed below, then checked and edited by Fiqhro Dedhen before publication. How we work.