Tool Use
Araç kullanımı
D3 · Prompts, context, RAG, tools and agents
Tool use is an application pattern in which a model’s output is used to select or call a configured function or external capability and process its result; provider documentation may call this function calling or tool calling.
Review status: 2026-11-26
Technical explanation
A system can process a model-produced function or tool request, execute the selected configured function, and return the result as input for a later model step.
Conceptual boundaries
Tool use is not an autonomous agent by itself; the cited loop only establishes function selection, execution, and result return. Function calling and tool calling are provider interface names, not evidence of a shared cross-provider protocol.
Provider-neutral example
A travel assistant calls a weather service before suggesting what to pack.
Limitations
Tool-enabled systems add security and downstream-action risks, especially when model output can reach external systems or untrusted data sources. A structured call or schema-conforming arguments do not establish that the requested action is authorized, safe, or factually appropriate.
Related concepts
Atomic claims and evidence
1.1NIST AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations
- Source
- NIST AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations
- Source role
- Authoritative source
- Exact locator
- Section 3.5 printed p. 54: model output, function call, and results returned in next prompt
- Supported claim
- NIST describes LLM-based agents as processing model output to select and call a function with specified inputs and returning results as part of a subsequent prompt.
- Last verification
- Review due
- Scope limitation
- This describes an agent tool-call loop and does not require every tool-enabled application to be an agent.
2.1NIST AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations
- Source
- NIST AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations
- Source role
- Authoritative source
- Exact locator
- Section 3.5 printed p. 54: tool-enabled agent security risks
- Supported claim
- When agents can take actions using tools, prompt-injection attacks can create risks such as arbitrary-code execution or data exfiltration.
- Last verification
- Review due
- Scope limitation
- This is a threat statement about vulnerable designs and does not establish that every tool call causes harm.
3.1OpenAI API, Function calling
- Source
- OpenAI API, Function calling
- Source role
- Authoritative source
- Exact locator
- Function calling guide: ‘A function call or tool call’ definition
- Supported claim
- OpenAI uses both “function call” and “tool call” for a model response that requests an available tool, while Anthropic describes tool use as also called function calling.
- Last verification
- Review due
- Scope limitation
- These are provider documentation names for related interface patterns; they do not prove an identical protocol, execution model, or safety property across providers.
3.2Anthropic API, Tool use with Claude
- Source
- Anthropic API, Tool use with Claude
- Source role
- Authoritative source
- Exact locator
- Tool use overview: ‘Tool use (also called function calling)’
- Supported claim
- OpenAI uses both “function call” and “tool call” for a model response that requests an available tool, while Anthropic describes tool use as also called function calling.
- Last verification
- Review due
- Scope limitation
- These are provider documentation names for related interface patterns; they do not prove an identical protocol, execution model, or safety property across providers.