Definition
Tool use (also function calling) is an LLM capability whereby the model can invoke external functions — search, calculator, API calls, database queries, file operations — by emitting a structured call that the host application executes and returns results from.
Tool use is what turns a chatbot into a system that does things. Without tools, an LLM is a knowledgeable consultant who can describe how to book a meeting but can't actually book one. With tools, it can check calendars, send invites, write to your CRM, query your database, run code, browse the web. The model becomes an action layer over your existing systems.
Designing tool interfaces is a craft. Each tool needs a clear name, a precise description of when to use it, a strict input schema, and a useful return format. Vague tool descriptions lead to wrong-tool-picks; loose return formats lead to parsing errors. Production tool-use systems treat the tool catalog as carefully as a public API design.
Origin
ReAct (Reason + Act, Yao et al. 2022) formalised the pattern of LLMs interleaving reasoning with tool calls. OpenAI's function-calling API (June 2023) made the pattern mainstream; every major LLM provider now supports structured tool use.
How it works
- Define each tool: name, description, JSON schema for inputs.
- Pass the tool catalog to the LLM along with the user query.
- The model emits either a direct response or a structured tool call.
- Your application executes the tool with the model's arguments.
- Return the tool's output to the model.
- The model continues reasoning, possibly calling more tools, until it returns a final answer.
When to use it
Use when
- When the task requires accessing external data or systems.
- When the LLM needs to perform calculations or operations it can't do reliably (math, dates, lookups).
- When the task requires multi-step actions across systems.
Skip when
- When the answer is in the model's training. Don't make a tool call to ask Wikipedia what year WWII ended.
- When the tool would expose unsafe or unbounded actions to LLM autonomy.
Key metrics
- Tool-call accuracy (right tool, right arguments).
- Tool-call success rate (tools that completed without error).
- End-to-end task success.
- Cost per task (tokens × tools × executions).
Examples
- Tool use lets the AI agent actually book the meeting, not just suggest one.
- Without tool use, the model is a blindfolded expert; with it, it's an assistant.
- Five well-described tools beat a generic 'execute this Python' tool every time.
In practice at Makreate
Makreate AI agents leverage tool use to query your CRM, hit your APIs, and write back to your systems — turning conversation into outcome. On a recent client engagement we built a sales-ops agent with 6 tools (lookup contact, enrich company, score lead, book meeting, log activity, summarise opportunity). Tightly-scoped tools made the planner's job easy; tool-call accuracy hit 96% in eval. The agent handles routine sales-ops tasks autonomously while flagging edge cases for humans.
AI Web App Development →Common mistakes
- Giving an agent every tool. Fewer, well-described tools beat dozens of vague ones.
- Vague tool descriptions. The model picks based on the description; vague = wrong picks.
- Loose input schemas. Without strict types, the model emits invalid arguments.
- Granting unsafe tool access (delete operations, payment writes) without confirmation gates.
- No retry / error handling. Tool calls fail; the system needs to recover gracefully.
Frequently asked
How many tools should I expose?
Fewer than you think. 3–10 tightly-scoped tools usually outperform 30 broad ones. Each additional tool dilutes the planner's ability to pick correctly.
Can the model call multiple tools at once?
Yes — modern LLMs (Claude 3+, GPT-4+) support parallel tool calls when the model decides multiple are needed. Useful for independent lookups.
How do I prevent dangerous tool use?
Capability gates (confirmation required for write operations), per-tool rate limits, and audit logging. Treat tool-using LLMs like any other system with API access — apply the same security model.