Tools & Function Calling

How Function Calling Works

Function calling follows a precise 4-step protocol between the LLM and your application:

Defining Tools

Tools are described to the LLM using JSON Schema. The better your tool definition, the more reliably the LLM will use it correctly.

import anthropic

client = anthropic.Anthropic()

# Tool definition — this is what the LLM "sees"
tools = [
    {
        "name": "search_database",
        "description": "Search the customer database by name, email, or order ID. Returns matching customer records with contact info and order history.",
        "input_schema": {
            "type": "object",
            "properties": {
                "query": {
                    "type": "string",
                    "description": "Search term: customer name, email address, or order ID (e.g., 'ORD-12345')"
                },
                "limit": {
                    "type": "integer",
                    "description": "Maximum number of results to return (default: 5)",
                    "default": 5
                }
            },
            "required": ["query"]
        }
    },
    {
        "name": "send_email",
        "description": "Send an email to a customer. Use for order confirmations, support responses, or follow-ups.",
        "input_schema": {
            "type": "object",
            "properties": {
                "to": {"type": "string", "description": "Recipient email address"},
                "subject": {"type": "string", "description": "Email subject line"},
                "body": {"type": "string", "description": "Email body (plain text)"}
            },
            "required": ["to", "subject", "body"]
        }
    }
]

# Send request with tools
response = client.messages.create(
    model="claude-sonnet-4-6",
    max_tokens=1024,
    tools=tools,
    messages=[{"role": "user", "content": "Find customer John Smith and send him a shipping update"}]
)

Executing Tool Calls

When the LLM decides to use a tool, it returns a tool_use content block with the tool name and arguments. Your code must execute it and feed the result back:

# Process the LLM's response
for block in response.content:
    if block.type == "tool_use":
        tool_name = block.name
        tool_input = block.input

        # Execute the actual function
        if tool_name == "search_database":
            result = search_database(**tool_input)
        elif tool_name == "send_email":
            result = send_email(**tool_input)

        # Feed the result back to the LLM
        follow_up = client.messages.create(
            model="claude-sonnet-4-6",
            max_tokens=1024,
            tools=tools,
            messages=[
                {"role": "user", "content": "Find customer John Smith and send him a shipping update"},
                {"role": "assistant", "content": response.content},
                {"role": "user", "content": [
                    {"type": "tool_result", "tool_use_id": block.id, "content": str(result)}
                ]}
            ]
        )

MCP: Model Context Protocol

MCP (Model Context Protocol) is an open standard by Anthropic that makes tools shareable across agents and applications. Instead of hard-coding tools in every agent, you run MCP servers that expose tools via a standard protocol.

# MCP server example (using FastMCP)
from mcp.server.fastmcp import FastMCP

mcp = FastMCP("customer-service")

@mcp.tool()
def search_customers(query: str, limit: int = 5) -> list[dict]:
    """Search the customer database by name, email, or order ID."""
    return db.search(query, limit=limit)

@mcp.tool()
def get_order_status(order_id: str) -> dict:
    """Get the current status of an order by its ID (e.g., ORD-12345)."""
    return orders.get_status(order_id)

# Run the server — any MCP-compatible agent can now use these tools
mcp.run()

Designing Great Tools

Well-designed tools dramatically improve agent reliability. Poorly designed tools cause confusion, errors, and wasted tokens.

Parallel Tool Calls

Modern LLMs can request multiple tools simultaneously when the calls are independent. This dramatically reduces latency for tasks that require gathering information from multiple sources.

# The LLM might return multiple tool_use blocks in one response:
# 1. search_database(query="John Smith")
# 2. get_order_status(order_id="ORD-12345")
#
# Execute them in parallel:
import asyncio

async def execute_parallel(tool_calls):
    tasks = [execute_tool(tc.name, tc.input) for tc in tool_calls]
    results = await asyncio.gather(*tasks)
    return results

Tool Security

Every tool is a potential attack vector. Treat agent tool use with the same rigor as a public API:

• Input validation — sanitize all LLM-generated inputs before execution
• Sandboxing — run code execution tools in containers or restricted environments
• Permission levels — classify tools as safe (read-only), moderate (write), and dangerous (delete, execute)
• Human-in-the-loop — require approval for dangerous operations
• Rate limiting — prevent runaway agents from making thousands of API calls
• Audit logging — record every tool call for review and debugging

Interview Questions