Function calling (also tool use) is a language model’s ability to generate a structured request to run an external tool instead of an ordinary textual reply. The application supplies the model with descriptions of the available functions – their name, purpose and parameter schema – and if the model judges that the query cannot be answered from its own weights, it returns the function name and arguments in machine-processable form, usually JSON. Crucially, the model does not run the function itself: it merely expresses an intent. Execution is performed by the host application, whose result is returned into the context window, from which the model composes the final answer. This makes function calling a natural security checkpoint where the application should enforce permissions and validation, because the source of the request is text susceptible to prompt injection. The technique overcomes three innate weaknesses of models: ignorance of current data, unreliability in exact computation, and the inability to write a change into an external system. Standardisation of the interface between model and tools is addressed by the Model Context Protocol, and the ability to chain calls autonomously is the basis of agentic systems.
It is like asking a colleague how much we sold last month. A good colleague does not invent a number. He says: “I will look it up in the system.” He opens the report, reads the value and answers you. The difference is that the model does not reach into the system itself – it only says “I need to run a query on June sales” and waits to see whether someone permits it and brings the result. That is a good thing: you do not guarantee that it cannot delete the database by asking it politely, but by not giving it the key.