Tool calling is the mechanism by which a large language model (LLM) asks a piece of outside software to do something on its behalf. Instead of answering only in prose, the model returns a structured request naming a function and its arguments, such as looking up a campaign's spend or creating an ad set. The application running the model executes that request, sends the result back, and the model continues. It exists because a model alone can only produce text from its training data. Tool calling gives it a controlled way to read fresh data and act in other systems, and it is the building block of AI agents.

The terms tool calling, tool use and function calling describe the same thing. OpenAI introduced the feature as "function calling" in 2023 and later renamed the parameters "tools"; Anthropic calls it "tool use"; Google's Gemini documentation still says "function calling".

How a tool call works

The process is a loop between the model, the application hosting it (the client or harness) and the external system doing the work.

  1. Declaration. The developer sends the model a list of available tools with each request. Every tool has a name, a plain-language description and a parameter schema written in JSON Schema, the standard vocabulary for describing the shape of JSON data. A reporting tool might declare a required string called campaign_id and an optional date_range.
  2. Decision. The model reads the user's request alongside those descriptions and decides whether a tool would help. If so, it stops generating prose and emits a structured block instead. In OpenAI's format that is a tool_calls entry with a function name and a JSON string of arguments; in Anthropic's it is a tool_use content block with an id, a name and an input object.
  3. Execution. The model runs nothing itself. The application parses and checks the request, calls the real API or database, and captures the output.
  4. Return. The output goes back to the model as a new message, tagged with the call's identifier so the model can match result to request. Anthropic labels this a tool_result block.
  5. Continuation. The model either answers the user using the result or requests another tool. An agent completing a multi-step task may run this loop dozens of times.

The model's understanding of a tool comes almost entirely from its name and description, which are injected into the context window as text. Definitions therefore count as input tokens on every request.

Schemas, choice and parallel calls

Three settings recur across provider application programming interfaces (APIs).

Tool choice controls whether the model may, must or must not call a tool. OpenAI's options are auto, required, none or a specific named function. Anthropic offers auto, any, a named tool and none, and Google's Gemini API uses modes such as AUTO, ANY and NONE.

Strict mode addresses a basic weakness: models sometimes produce arguments that do not match the schema. OpenAI's Structured Outputs, launched on August 6, 2024, lets developers set strict: true on a function definition so that output is constrained to the schema during generation. According to OpenAI, gpt-4o-2024-08-06 with Structured Outputs scored 100% on its schema-following evaluation, against less than 40% for gpt-4-0613, the first function-calling model. OpenAI's documentation added a caveat: Structured Outputs "is not compatible with parallel function calls", and developers using it are told to set parallel_tool_calls: false.

Parallel calls let a model request several independent tools in one turn, such as pulling spend from three ad accounts at once. OpenAI announced the capability on November 6, 2023. When Anthropic made tool use generally available on May 30, 2024, its announcement noted that Claude 3 models were "currently unable to support parallel tool calls"; later Claude models added it.

Origins and evolution

Academic work preceded the products. ReAct, a paper by Shunyu Yao and colleagues submitted to arXiv on October 6, 2022, showed models interleaving reasoning steps with actions such as searching Wikipedia. Toolformer, submitted on February 9, 2023 by Timo Schick and seven co-authors, trained a model to decide for itself when to call a calculator, search engine or translation system by inserting API calls into text.

OpenAI turned the idea into a product on June 13, 2023. Developers could "describe functions to gpt-4-0613 and gpt-3.5-turbo-0613, and have the model intelligently choose to output a JSON object containing arguments to call those functions," according to the company's announcement, which specified JSON Schema as the description format. That choice became the de facto standard. Anthropic followed, making tool use generally available on May 30, 2024.

The next problem was integration cost: every application had to write its own connector for every service. Anthropic published the Model Context Protocol (MCP) in November 2024, with a first specification revision dated 2024-11-05, as a common way for applications to discover and call tools hosted on separate servers. OpenAI and Google subsequently added MCP support to their own products. On December 9, 2025, Anthropic donated MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded with Block and OpenAI, citing more than 10,000 active public MCP servers and more than 97 million monthly downloads of its Python and TypeScript software development kits (SDKs).

Scale created a further problem: too many tools. In a post dated November 24, 2025, Anthropic engineers described a setup of 58 tools "consuming approximately 55K tokens before the conversation even starts," and said internal deployments had seen tool definitions reach 134,000 tokens. It released a tool search tool, which loads definitions on demand, and programmatic tool calling, in which the model writes code orchestrating several tools; Anthropic reported a 37% average token reduction for the latter. OpenAI's current documentation suggests keeping fewer than 20 functions available at the start of a turn, describing that as "a soft suggestion".

Why it matters for marketing

For advertisers, tool calling is what lets an AI assistant work inside an ad account rather than describe one. Google released an open-source MCP server for the Google Ads API in October 2025. Amazon Ads put its MCP server into open beta on February 2, 2026, an intermediary that turns plain-language requests into structured Amazon Ads API calls. Meta opened its ads MCP server to any app in July 2026, and HubSpot committed to API parity and an MCP server on May 4, 2026.

The volumes are starting to show. Ads Uploader, a bulk upload tool for Meta ads, reported that 17.5% of 36,289 ad batches in September 2026 came from AI agents such as Claude or ChatGPT, arriving through its MCP server or command line rather than its interface. In programmatic trading, the Ad Context Protocol (AdCP) runs on MCP, so a buyer agent requesting inventory is, mechanically, issuing tool calls.

Limitations and disputes

Accuracy remains uneven. The Berkeley Function Calling Leaderboard, now in its fourth version and last updated on April 12, 2026, scores models on choosing the right function, filling arguments correctly and handling multi-step agentic tasks. A syntactically valid call can still carry the wrong campaign identifier or date.

Cost compounds. Every step of an agent loop re-sends the conversation and tool definitions. OpenRouter data showed AI agents using five times more tokens than humans, and the Dutch agency Draft Digital collapsed twelve MCP calls into one buyer agent because each produced its own context load, authentication path and set of instructions, though it published no token counts.

Security is the most contested area. Tool descriptions and tool outputs both enter the model's context, so a malicious server can hide instructions in a description, and a web page returned by a search tool can carry prompt injection. Researchers flagged tool-poisoning risks in MCP implementations in July 2025. The MCP specification itself says there "SHOULD always be a human in the loop with the ability to deny tool invocations," and that clients must treat tool annotations, such as a hint that a tool only reads data, as untrusted unless the server is trusted. Those are recommendations, not enforcement, and how much confirmation an agent should require before spending budget is unresolved.

Fragmentation persists. Providers support different subsets of JSON Schema and differ on parallel and strict behaviour, so a definition that works with one model may need rewriting for another.

  • Structured outputs. Constrains a model's reply to a schema. Tool calling uses the same constraint but adds the loop: the output is a request for action that someone executes.
  • MCP. A protocol for hosting and discovering tools on separate servers. Tool calling is the model capability; MCP is one way to supply the tools.
  • Computer use. The model operates a screen through clicks and keystrokes. A computer use agent acts on pixels rather than defined APIs.
  • API call. The underlying request to a service. In tool calling the model proposes it and the application makes it.

Recent developments

The MCP specification dated 2026-07-28, marked as latest on the project's site as of November 2026, removed the protocol's initialisation handshake and session identifiers so that each tool call stands alone and can be handled by any server instance. It also asked servers to list tools in a deterministic order to improve prompt cache hit rates. Network controls are following the traffic: in August 2026 Cloudflare said its Gateway could block MCP calls that bypass approved portals. Commercial scale is still limited. Adform's chief technology officer, Jochen Schlosser, said in September 2026 that neither of ad tech's two AI agent protocols runs at scale, with "very little money" flowing through either.

Timeline

  • October 6, 2022 - ReAct paper submitted to arXiv, combining model reasoning with actions.
  • February 9, 2023 - Toolformer paper submitted, training a model to insert API calls.
  • June 13, 2023 - OpenAI launches function calling with gpt-4-0613 and gpt-3.5-turbo-0613, using JSON Schema.
  • November 6, 2023 - OpenAI announces parallel function calling at DevDay.
  • May 30, 2024 - Anthropic makes Claude tool use generally available on its API, Amazon Bedrock and Vertex AI.
  • August 6, 2024 - OpenAI launches Structured Outputs with strict: true for functions.
  • November 2024 - Anthropic publishes the Model Context Protocol; first revision dated 2024-11-05.
  • July 2025 - Researchers flag tool-poisoning risks in MCP implementations.
  • October 2025 - Google releases an open-source MCP server for the Google Ads API.
  • November 24, 2025 - Anthropic describes tool search and programmatic tool calling.
  • December 9, 2025 - MCP donated to the Agentic AI Foundation under the Linux Foundation.
  • February 2, 2026 - Amazon Ads MCP server enters open beta.
  • April 12, 2026 - Berkeley Function Calling Leaderboard V4 last updated.
  • May 4, 2026 - HubSpot commits to an MCP server and API parity.
  • July 2026 - Meta opens its ads MCP server to any app.
  • July 28, 2026 - MCP specification revision makes the protocol stateless.
  • August 2026 - Cloudflare Gateway begins blocking unapproved MCP calls.
  • October 7, 2026 - Ads Uploader reports 17.5% of Meta ad batches came from AI agents.

Summary

Who: Model providers including OpenAI, Anthropic and Google build tool calling into their APIs; developers and platforms such as Google Ads, Amazon Ads, Meta and HubSpot supply the tools; the Agentic AI Foundation now stewards MCP.

What: A mechanism in which an LLM returns a structured request, a function name plus JSON arguments matching a declared schema, which the host application executes before returning the result to the model.

When: Research prototypes appeared in 2022 and early 2023; OpenAI launched function calling on June 13, 2023; MCP followed in November 2024, with its latest revision dated July 28, 2026.

Where: Inside provider APIs and agent applications, and increasingly across MCP servers run by advertising platforms, CRMs and ad tech vendors.

Why: Models cannot see live data or act on their own. Tool calling gives them a bounded, inspectable way to do both, at the price of token cost, reliability gaps and new security risks.