Function Calling / Tool Calling

1. Concept Overview & Systemic Problem

The language model is confined within its own context: it does not know the current exact time, cannot withdraw funds from an account, or check the status of a container in Docker.

Without a mechanism for interaction with code, a chatbot could only simulate actions, returning vague text: “I checked your balance, it’s $50” (even if the balance is $0).

Function Calling (Tool Calling) transforms the text generator into a systems orchestrator. The model analyzes the prompt, realizes it lacks data, and instead of text, generates machine-readable JSON:

{
  "name": "fetch_user_balance",
  "arguments": "{\"account_id\": \"ACC-9481\"}"
}

Mental model: if the LLM is the brain, then Function Calling is the nerve impulses sending commands to the muscles (your code and API) to perform physical actions.

┌─────────────────────────────────────────────────────────────┐
│                 FUNCTION CALLING ARCHITECTURE              │
├─────────────────────────────────────────────────────────────┤
│ 1. USER REQUEST:                                            │
│    “What’s the weather in Lviv?”                           │
├─────────────────────────────────────────────────────────────┤
│                          │                                  │
│                          ▼ Request to LLM (with schema)    │
├─────────────────────────────────────────────────────────────┤
│ 2. LLM RESPONSE (finish_reason: "tool_calls"):             │
│    { "name": "get_weather", "args": { "city": "Lviv" } }   │
├─────────────────────────────────────────────────────────────┤
│                          │                                  │
│                          ▼ Backend executes real API call  │
├─────────────────────────────────────────────────────────────┤
│ 3. YOUR SERVER ➔ OpenWeatherMap ➔ Receives { temp: 18, rain: 0} │
├─────────────────────────────────────────────────────────────┤
│                          │                                  │
│                          ▼ Sends result back to LLM       │
├─────────────────────────────────────────────────────────────┤
│ 4. FINAL RESPONSE TO USER:                                  │
│    “It’s currently +18°C in Lviv, no precipitation, have a great day!” │
└─────────────────────────────────────────────────────────────┘

2. Practical Example: Schema Description and cURL Invocation

Here’s how to register a tool in the OpenAI / Anthropic Tool Calling standard:

curl https://api.openai.com/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -d '{
    "model": "gpt-4o",
    "messages": [
      {"role": "user", "content": "Block user card 5501"}
    ],
    "tools": [
      {
        "type": "function",
        "function": {
          "name": "block_payment_card",
          "description": "Securely block a user’s bank card in case of loss",
          "parameters": {
            "type": "object",
            "properties": {
              "card_id": {
                "type": "integer",
                "description": "Unique identifier of the card in the system"
              },
              "reason": {
                "type": "string",
                "enum": ["lost", "stolen", "fraud"],
                "description": "Reason for blocking"
              }
            },
            "required": ["card_id", "reason"]
          }
        }
      }
    ],
    "tool_choice": "auto"
  }'

What the model returns:

{
  "role": "assistant",
  "content": null,
  "tool_calls": [
    {
      "id": "call_abc123",
      "type": "function",
      "function": {
        "name": "block_payment_card",
        "arguments": "{\"card_id\": 5501, \"reason\": \"lost\"}"
      }
    }
  ]
}

3. Four Security Rules for Working with Function Calling

1. Strict Argument Validation (Pydantic / Zod): Never blindly trust arguments from the JSON model. Always parse them through a validation schema before executing SQL queries or withdrawing funds.
2. Control Gateway for Destructive Actions (Human-in-the-Loop): If a function performs an irreversible operation (delete_database, transfer_funds), the backend must halt execution and request confirmation from a human.
3. Context Limitation for Tools: Do not pass hundreds of functions to the model simultaneously. This dilutes attention (Attention Saturation) and increases the likelihood of erroneous calls. Use dynamic filtering or MCP.
4. Protection Against Infinite Loops: Always set a hard limit on the number of consecutive function calls (e.g., no more than 5 iterations per request).

4. Production Engineering Scenarios

Function Calling is a bridge connecting the world of statistical language modeling with the deterministic realm of programming. This mechanism is at the core of all modern AI agents, MCP servers, and autonomous developer assistants.