Tools

How a tool call works

OpenAI gives five steps for a tool call. Anthropic and the Model Context Protocol use the same shape.

1. The application sends the user text and a list of tools to the language model.
2. The model gives back a tool call: a tool name and arguments.
3. The application runs the tool with those arguments.
4. The application sends the tool result to the model.
5. The model writes the last answer, or it makes more tool calls.

Why tools are a security risk

A tool changes the effect of a bad output. Without tools, a bad output is only text. OpenAI gave examples of tool steps with a real effect: “sending an email, posting online, or making a purchase”.

OWASP calls the risk excessive agency. It names three causes:

1. Too much functionality. In the OWASP example, the task is to read documents, but the extension can also “modify and delete documents”.
2. Too much permission. The tool has more access than the task needs.
3. Too much autonomy. The tool does high risk steps with no human check.

An attacker can write two types of text that the model reads:

• Tool descriptions. This is MCP tool poisoning.
• Tool results. A web page or an email from a tool goes into the model as text. This is the path of indirect prompt injection.

What a tool definition holds

Anthropic says Claude uses the user request and the tool description to select a tool. The MCP specification of 18 June 2025 gives these fields:

Field	What it holds
name	A unique identifier
description	What the tool does, in plain text
inputSchema	A JSON Schema for the arguments
outputSchema	An optional JSON Schema for the result
annotations	Optional hints about the behavior of the tool

The MCP specification tells clients not to trust annotations “unless they come from trusted servers”.

The user can see less than the model. Invariant Labs, a security vendor, showed instructions in MCP tool descriptions that are “invisible to users but visible to AI models” (1 April 2025).

Where tool use came from

• October 2022. In the ReAct paper, a model writes reasoning and tool steps in turn. One tool is “a simple Wikipedia API”.
• February 2023. Toolformer trains a model “to decide which APIs to call, when to call them, what arguments to pass”.
• 13 June 2023. OpenAI adds function calling to its API. On the same day, OpenAI tells developers to add user confirmation before steps with a real effect.
• 18 June 2025. This MCP specification version tells how a server offers tools and how a client calls them.

Controls in the MCP specification

The MCP specification gives tasks to each side of a tool call.

Side	Tasks in the specification
Server (MUST)	Check all tool inputs. Use access controls. Set a rate limit on tool calls. Clean tool outputs.
Client (SHOULD)	Show tool inputs to the user before the call. Check tool results before they go to the model. Keep a record of tool calls for audit.
Human (SHOULD)	A person who can stop each tool call.

These controls work outside the model. The human in the loop, least privilege and tool misuse pages show how to apply them.

Questions and answers

Is tool use the same as function calling?

Yes. Anthropic writes "Tool use (also called function calling)". OpenAI writes "Function calling (also known as tool calling)". The Model Context Protocol uses the word "tools". All three describe a model that writes a structured call and software outside the model that runs it.

Does the AI model run the tool itself?

No. The model writes the name of the tool and the arguments. OpenAI says "When the model calls a function, you must execute it and return the result." Anthropic runs some server tools, such as web search, on its own infrastructure. In both cases, software outside the model does the work.

Why are tools a security risk?

A tool turns text from the model into a real step. Text from a web page, an email or a tool description can change what the model asks for. OWASP names three causes of damage: too many functions, too much permission and too much autonomy.