Tool calling

A model can only produce text. Tool calling (also called function calling) lets it ask your program to do something: look up an order, search documents, run a calculation.

You describe each tool in the request: a name, what it's for, and its parameters as JSON Schema. When the model decides a tool would help, it replies with a tool call (the tool's name and the arguments) instead of an answer. Your code runs the tool, sends the result back, and the model carries on: it may call another tool or write the answer.

{"name": "get_order_status",
 "description": "Look up where an order is. Use when the customer asks about an order they placed.",
 "parameters": {"type": "object",
   "properties": {"order_id": {"type": "string", "description": "Like A-1042"}},
   "required": ["order_id"]}}

The model never runs anything itself. It only asks. Your code decides whether to run the call, checks the arguments, and runs the tool with only the permissions it needs. That's where safety lives.

def get_order_status(order_id):
    return {"A-1042": "shipped", "A-1043": "packing"}.get(order_id, "not found")

tools = {"get_order_status": get_order_status}
call = {"name": "get_order_status", "arguments": {"order_id": "A-1042"}}
result = tools[call["name"]](**call["arguments"])
print(result)

Good tools are easy for the model to use well: clear names, a description that says when to use it, parameters with examples, and small, relevant results (not a 5,000-row dump). When something goes wrong, return an error the model can act on, like "No order A-10422. Order ids look like A-1042", rather than crashing.

Be careful with tools that change things: issuing refunds, sending email, deleting records. Check the arguments against your own rules (a refund can't exceed what was paid), ask a person to confirm big or irreversible actions, and log every call.